5 matches found
CVE-2026-93017
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...
CVE-2026-93017 Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...
EUVD-2026-95030
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...
CVE-2026-93017
The insights-operator contains a security misconfiguration where the insights-operator-gather ClusterRole grants the gather service account excessive permissions. Specifically, it allows read access (get, list) to secrets in the core API group without any namespace or resource names restrictions....
CVE-2026-93017
The insights-operator-gather ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref:...