CVE-2026-73834: Red Hat ACM Information Disclosure Flaw

CVE-2026-73834 Overview

CVE-2026-73834 is an information disclosure vulnerability in the must-gather component of Red Hat Advanced Cluster Management (ACM) for Kubernetes. The flaw exists because certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather for diagnostic purposes, credentials and tokens are captured in cleartext within the resulting archive. Anyone with access to that archive can extract the exposed secrets. The vulnerability is tracked under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Diagnostic archives generated by ACM must-gather contain unredacted credentials and tokens, allowing anyone with archive access to obtain valid authentication material.

Affected Products

Red Hat Advanced Cluster Management for Kubernetes
ACM must-gather diagnostic component
ACM wrapper Custom Resources that embed Secret data

Discovery Timeline

2026-08-18 - CVE-2026-73834 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73834

Vulnerability Analysis

Red Hat Advanced Cluster Management ships a must-gather tool that collects diagnostic data across managed clusters. The tool is designed to gather Custom Resource definitions, controller logs, and cluster state for troubleshooting. Standard Kubernetes Secret objects are typically redacted or excluded from these collections.

ACM defines wrapper Custom Resources that embed Secret data inline rather than referencing external Secret objects. The must-gather collection logic does not detect these embedded credentials and copies the resources verbatim into the archive. The result is a diagnostic bundle that contains cleartext tokens, passwords, and other authentication material.

Because diagnostic archives are frequently shared with support teams, uploaded to case management systems, or stored on shared file systems, the exposure surface extends beyond the cluster administrator who generated the file.

Root Cause

The root cause is missing redaction logic for ACM wrapper Custom Resources. The must-gather collector treats these resources as generic Custom Resources rather than as secret-bearing objects. Redaction rules cover native Secret kinds but do not extend to ACM-specific CRDs that embed secret material in their spec fields. This maps to CWE-312: Cleartext Storage of Sensitive Information.

Attack Vector

Exploitation requires local access to a generated must-gather archive. An authenticated user with low privileges who can run must-gather or read its output can extract credentials. The attack does not require network access or user interaction. Confidentiality impact is high; integrity and availability are unaffected. Refer to the Red Hat CVE-2026-73834 advisory and Red Hat Bug Report #2517904 for vendor details.

The vulnerability manifests during archive generation. See the security advisory for technical details on the specific wrapper Custom Resources affected.

Detection Methods for CVE-2026-73834

Indicators of Compromise

Presence of must-gather archives on shared storage, ticketing systems, or workstations outside the originating cluster administrator's control.
ACM wrapper Custom Resource YAML files inside must-gather output containing base64-encoded or plaintext values in fields typically reserved for Secret references.
Access logs showing reads of must-gather-*.tar.gz archives by accounts that did not generate them.

Detection Strategies

Scan existing must-gather archives for high-entropy strings, JWT patterns, and known credential formats using tools such as trufflehog or gitleaks.
Inventory ACM wrapper Custom Resources across managed clusters and correlate their spec contents with fields flagged as sensitive in the vendor advisory.
Audit Kubernetes RBAC for accounts holding the ability to run oc adm must-gather against ACM namespaces.

Monitoring Recommendations

Alert on creation, upload, or transfer of files matching must-gather*.tar.gz outside approved support workflows.
Log and review all invocations of the ACM must-gather image and capture the identity of the invoking user.
Monitor object storage buckets and case-attachment systems for uploads of ACM diagnostic archives and restrict retention windows.

How to Mitigate CVE-2026-73834

Immediate Actions Required

Treat all existing ACM must-gather archives as sensitive and restrict access to authorized incident responders only.
Rotate credentials, tokens, and service account keys that may have been captured in previously generated archives.
Delete or securely wipe must-gather archives stored in shared locations, ticketing systems, or backup targets that no longer require retention.

Patch Information

Red Hat is tracking remediation under the official CVE-2026-73834 advisory and Bugzilla #2517904. Apply the fixed ACM release once it is published by Red Hat and follow the vendor's guidance for regenerating diagnostic bundles with the patched collector.

Workarounds

Manually inspect and redact ACM wrapper Custom Resource YAML files inside the archive before sharing it with support or third parties.
Restrict permission to run must-gather against ACM namespaces to a minimal set of trusted cluster administrators via Kubernetes RBAC.
Store diagnostic archives on encrypted volumes with strict access controls and enforce short retention periods.
Rotate any credentials referenced by ACM wrapper Custom Resources on a regular schedule to limit the value of leaked archives.

bash

# Configuration example: restrict who can execute ACM must-gather
# Review roles that grant pod exec or must-gather image execution
oc get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects'

# Scan an existing must-gather archive for embedded secrets before sharing
tar -xzf must-gather.tar.gz -C ./mg-review
grep -RIEn 'password|token|BEGIN [A-Z ]*PRIVATE KEY|eyJ[A-Za-z0-9_-]{20,}' ./mg-review