Executive brief
Red Hat Advanced Cluster Management and Multicluster Engine contain a flaw where sensitive login credentials (pull-secrets) are accidentally written into publicly readable status messages. This allows users with basic 'view' permissions, who should not have access to passwords or keys, to see and steal these credentials if a validation error occurs. An attacker could use these stolen credentials to access private image registries or other protected resources.
Technical details
The vulnerability is an information disclosure (CWE-201) within the ACM/MCE assisted-service component. When pull-secret validation fails, the service writes the raw contents of the referenced secret into the `InfraEnv.status.conditions[].message` field. This creates an RBAC bypass because the standard Kubernetes/OpenShift 'view' ClusterRole permits reading `InfraEnv` objects but restricts reading `Secrets`. An authenticated attacker with namespace-level view privileges can extract `.dockerconfigjson` data, including usernames, passwords, and base64-encoded authentication tokens, directly from the object status.
Affected products
- Red Hat Advanced Cluster Management for Kubernetes (ACM)
- Red Hat Multicluster Engine (MCE)
Timeline
- 2026-05-29: disclosed: Vulnerability reported and published via NVD and Red Hat Bugzilla.