# CVE-2026-93017: Red Hat OpenShift insights-operator privilege escalation via unrestricted secret access

Source: https://junglewise.ai/threats/cve-2026-93017-the-insights-operator-gather-clusterrole-grants-the-operator-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-93017 · Severity: high · CVSS 7.7 · Published 2026-10-08

The insights-operator component in Red Hat OpenShift has a configuration flaw that grants its service account read access to all secrets across every namespace in the cluster without proper restriction. An attacker who can create a pod using the operator's service account can access sensitive credentials and data stored in any cluster secret, potentially leading to unauthorized access to other systems and applications.

Technologies: [Red Hat OpenShift](https://junglewise.ai/threats/technologies/red-hat-openshift). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-93017 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93017 being exploited in the wild.

**How severe is CVE-2026-93017?** High severity, with a CVSS score of 7.7, published 8 October 2026.

**Which products and versions are affected?** Red Hat OpenShift <UNKNOWN>.

**Is there a fix for CVE-2026-93017?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93017 attacked?** It is attacked with local access or from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-93017?** Check whether you run Red Hat OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The insights-operator-gather ClusterRole defines overly permissive RBAC rules that allow the service account to get and list secrets from the core API group without namespace or resourceNames restrictions. By creating a pod with the gather service account mounted, an attacker gains read access to all secrets cluster-wide. This is a Kubernetes RBAC misconfiguration that enables privilege escalation and lateral movement within the cluster.

## Affected products

- Red Hat OpenShift <UNKNOWN>

## Timeline

- 2026-10-08: disclosed

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)

## Related threats

- [OpenShift image-customization-controller unauthenticated file server exposes credentials](https://junglewise.ai/threats/cve-2026-82976-a-flaw-was-found-in-the-image-customization-controller-used-in)
- [OpenShift client oc path traversal in image extract](https://junglewise.ai/threats/cve-2026-115424-a-flaw-was-found-in-the-openshift-client-oc-when-extracting)
- [OpenShift console SSRF in Helm chart URL validation](https://junglewise.ai/threats/cve-2026-75888-a-flaw-was-found-in-the-openshift-console-an-authenticated)