HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-93017 — The `insights-operator-gather` ClusterRole grants the operator's service account...

·Source: NIST NVD

Updated:

Executive Summary

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups:

Analysis

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ``` CVSS Score: 7.7. Published: 2026-10-08T15:17:56.950.

Indicators of Compromise (2)

SHA-1 (1)
8f15e3157ff09f54ab22801f5b21da35a195cc6d
VirusTotalAnyRunJoe Sandbox
CVE (1)
CVE-2026-93017
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

BleepingComputer
MEDIUMVulnerability

Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

BleepingComputer
MEDIUMVulnerability

Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

SANS ISC