# CVE-2026-71846: Red Hat insights-client excessive Kubernetes permissions in ServiceAccount

Source: https://junglewise.ai/threats/cve-2026-71846-red-hat-insights-client-excessive-kubernetes-permissions-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71846 · Severity: medium · CVSS 6.5 · Published 2026-08-12

insights-client is a Red Hat component deployed as a pod in Kubernetes clusters that monitors system health and configuration. Its service account has been granted excessive permissions to read all secrets cluster-wide, far beyond what the component actually needs. If the insights-client pod or its credentials are compromised, an attacker could read sensitive data including kubeconfigs and authentication tokens from all clusters managed by the hub.

Technologies: [Redhat Advanced Cluster Management For Kubernetes](https://junglewise.ai/threats/technologies/advanced-cluster-management-for-kubernetes), [Redhat Insights-Client](https://junglewise.ai/threats/technologies/insights-client). Vendors: [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-71846 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71846 being exploited in the wild.

**How severe is CVE-2026-71846?** Medium severity, with a CVSS score of 6.5, published 12 August 2026.

**Which products and versions are affected?** Red Hat Advanced Cluster Management for Kubernetes v2.17.1.

**Is there a fix for CVE-2026-71846?** A patch was published on 2026-09-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71846 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-71846?** Check whether you run Redhat Advanced Cluster Management For Kubernetes or Redhat Insights-Client. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a privilege escalation issue stemming from over-permissioned Kubernetes RBAC (Role-Based Access Control). The insights-client ServiceAccount is bound to a ClusterRole that grants get, list, and watch permissions on all secrets cluster-wide, while the actual code only requires read access to a single specific secret. The attack vector requires compromise of either the insights-client pod or theft of its service account token (which could occur via pod escape, compromised container image, or node-level access). A successful attack grants an attacker read access to all secrets in the Kubernetes cluster, potentially exposing kubeconfigs for managed clusters and other sensitive credentials. The fix reduces the ClusterRole permissions to the minimum required—access only to the specific secret needed by the component.

## Affected products

- Red Hat Advanced Cluster Management for Kubernetes v2.17.1

## Timeline

- 2026-08-26: disclosed
- 2026-09-01: patched

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/errata/RHSA-2026:60386](https://access.redhat.com/errata/RHSA-2026:60386)

## Related threats

- [A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it…](https://junglewise.ai/threats/cve-2026-71845-a-flaw-was-found-in-insights-client-the-setdefault-function-logs)
- [A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded…](https://junglewise.ai/threats/cve-2026-71475-a-flaw-was-found-in-insights-client-a-compromised-managed-cluster)
- [A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers…](https://junglewise.ai/threats/cve-2026-71474-a-flaw-was-found-in-insights-client-when-the-application-receives)
- [Red Hat Multicluster Engine for Kubernetes privilege escalation in /etc/passwd](https://junglewise.ai/threats/cve-2025-57851-red-hat-multicluster-engine-for-kubernetes-privilege-escalation)
- [Open Cluster Management privilege escalation in certificate renewal validation](https://junglewise.ai/threats/cve-2026-4740-open-cluster-management-privilege-escalation-in-certificate)