CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

Information Disclosure

@mittwald/kubernetes is vulnerable to information disclosure. The vulnerability exists in client.ts when debug logging is enabled which allows an attacker to get access to secret contents leaked via debug logging...