CVE-2026-75485 Overview
A flaw exists in the must-gather component of Red Hat Advanced Cluster Management (RHACM) for Kubernetes. The component dumps the cluster Proxy object in raw form, bypassing the oc inspect redaction that normally sanitizes sensitive fields. As a result, proxy basic-authentication credentials are written to the must-gather archive in cleartext. Anyone with read access to the archive can recover these credentials and reuse them against the proxy infrastructure. The issue is classified under CWE-532 (Insertion of Sensitive Information into Log File).
Critical Impact
Proxy basic-auth credentials are disclosed in must-gather archives, enabling downstream credential reuse against corporate proxy infrastructure.
Affected Products
- Red Hat Advanced Cluster Management for Kubernetes
- must-gather diagnostic component within RHACM
- Cluster environments configured with a Proxy object containing basic-auth credentials
Discovery Timeline
- 2026-08-18 - CVE-2026-75485 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75485
Vulnerability Analysis
Red Hat Advanced Cluster Management ships a must-gather utility that collects cluster state for support and diagnostics. The utility typically relies on oc inspect to serialize Kubernetes resources, and oc inspect applies a redaction layer that masks known sensitive fields before writing files to disk.
For the cluster-scoped Proxy resource, must-gather bypasses this redaction path and writes the object in raw form. The Proxy object can hold httpProxy and httpsProxy URLs that embed basic-authentication credentials in the form http://username:password@proxy.example.com. Those credentials are preserved verbatim in the archive.
Because must-gather archives are routinely shared with support engineers, uploaded to ticketing systems, and stored on shared file systems, the exposure surface is broad. A local user with read access to a stored archive can extract working proxy credentials without any interaction with the cluster.
Root Cause
The root cause is inconsistent use of the redaction pipeline. The Proxy object is serialized directly rather than through the sanitizing wrapper, so field-level redaction rules that apply to secrets and credentialed URLs are not enforced for this resource type.
Attack Vector
Exploitation is local and requires low-privileged access. An attacker who reads a must-gather archive on a workstation, support portal, or backup share can search the extracted YAML or JSON for the Proxy object and recover the embedded credentials. No cluster access is required once the archive is obtained.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-75485
Indicators of Compromise
- Presence of a cluster.yaml or proxy.yaml file within a must-gather archive containing httpProxy or httpsProxy values with embedded user:password@ credentials.
- Unexpected outbound authentication attempts to the corporate proxy from hosts that previously accessed shared must-gather archives.
- must-gather archives stored in ticket attachments, object storage buckets, or shared drives without access controls proportional to their sensitivity.
Detection Strategies
- Scan existing must-gather tarballs for the regex pattern https?://[^:]+:[^@]+@ within any file matching *proxy* or *cluster*.
- Audit RHACM support archives generated before patch application and treat any that include a populated Proxy object as compromised credential material.
- Correlate proxy authentication logs with the timeframe of must-gather collection and distribution to identify anomalous reuse.
Monitoring Recommendations
- Log and alert on oc adm must-gather invocations targeting RHACM images.
- Restrict who can generate, download, and forward must-gather archives, and record those actions in an auditable system.
- Monitor proxy authentication for logins originating from unexpected source ranges or service accounts.
How to Mitigate CVE-2026-75485
Immediate Actions Required
- Rotate the basic-auth credentials configured in the cluster Proxy object on any cluster where must-gather has been executed and the archive left the trust boundary.
- Locate and securely delete or restrict access to prior must-gather archives that predate remediation.
- Review Red Hat's advisory at Red Hat CVE Security Notice and the tracking issue at Red Hat Bug Report #2517905 for fixed component versions.
Patch Information
Red Hat tracks remediation through the advisory linked above. Apply the fixed must-gather image once released by Red Hat, and regenerate any archives that must be retained using the patched version. Until the patched image is deployed, treat every generated archive as containing plaintext proxy credentials.
Workarounds
- Manually redact httpProxy, httpsProxy, and noProxy fields from the Proxy object output in must-gather archives before sharing.
- Configure the cluster Proxy object to reference credentials via a Secret reference pattern where supported, rather than embedding them in the URL string.
- Store must-gather archives on encrypted volumes with strict role-based access control, and expire them on a short retention schedule.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
