CVE-2026-93017: OpenShift Insights Operator Disclosure Flaw

CVE-2026-93017 Overview

CVE-2026-93017 is a privilege management flaw [CWE-269] in the OpenShift insights-operator. The insights-operator-gather ClusterRole grants the operator's service account get and list verbs on secrets in the core API group. The role sets no namespace or resourceNames restriction. Any workload that mounts the gather service account can read every secret in every namespace across the cluster. An attacker with permission to create a pod bound to that service account escalates to cluster-wide secret disclosure.

Critical Impact
Any principal able to schedule a pod using the gather service account can read all Kubernetes secrets cluster-wide, including API tokens, kubeconfig credentials, and TLS private keys.

Affected Products

Red Hat OpenShift Container Platform insights-operator component
Clusters deploying the insights-operator-gather ClusterRole as defined in manifests/03-clusterrole.yaml
Workloads referencing serviceAccountName: gather in the operator namespace

Discovery Timeline

2026-10-08 - CVE-2026-93017 published to NVD
2026-10-10 - Last updated in NVD database

Technical Details for CVE-2026-93017

Vulnerability Analysis

The insights-operator collects cluster diagnostic data for Red Hat Insights. To gather this data it binds the gather service account to the insights-operator-gather ClusterRole. The ClusterRole declares an overly broad rule:

- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list

Because ClusterRoles apply across every namespace and this rule omits any resourceNames filter, the service account can enumerate and read every Secret object in the cluster. Secrets in Kubernetes typically contain service account tokens, image pull credentials, TLS private keys, database passwords, and integration tokens for external systems.

Root Cause

The root cause is a least-privilege violation in the operator's RBAC manifest. Secret collection should be scoped to specific namespaces or specific secret names required for Insights gathering. Instead the manifest grants unrestricted cluster-wide read on the entire secrets resource. This design error turns the service account into a cluster-wide credential oracle for any workload that can assume it.

Attack Vector

An attacker who holds create permission on Pod objects in the namespace where the gather service account resides can schedule a pod that mounts the service account token:

spec:
  serviceAccountName: "gather"

The mounted token inherits the ClusterRole bindings. From inside the pod the attacker calls the Kubernetes API, for example GET /api/v1/secrets, and receives every secret across every namespace. Credentials extracted this way enable lateral movement to cloud provider APIs, CI/CD systems, external databases, and the cluster control plane via recovered kubeconfig or cluster-admin tokens.

Detection Methods for CVE-2026-93017

Indicators of Compromise

Pods in the insights-operator namespace with serviceAccountName: gather that were not created by the operator's controller
API server audit log entries showing list or get on secrets across many namespaces from the gather service account within a short interval
Unexpected egress traffic from pods using the gather token to external destinations

Detection Strategies

Enable Kubernetes API server audit logging at the Metadata level or higher and alert on secrets reads by system:serviceaccount:openshift-insights:gather originating from pods other than the operator
Baseline the operator's normal secret access pattern and alert on deviations in volume, namespace scope, or source pod name
Use admission controllers such as Kyverno or OPA Gatekeeper to flag or block any new Pod spec referencing serviceAccountName: gather

Monitoring Recommendations

Forward OpenShift audit logs to a centralized analytics pipeline and retain for incident reconstruction
Monitor RBAC changes to insights-operator-gather ClusterRole and ClusterRoleBindings for drift
Track pod creation events in operator namespaces and correlate the service account field with the requesting user identity

How to Mitigate CVE-2026-93017

Immediate Actions Required

Apply the Red Hat security update for the insights-operator once available; consult the Red Hat CVE-2026-93017 Advisory for fixed versions
Restrict create and update permissions on Pod and workload resources in the insights-operator namespace to cluster administrators only
Audit existing ClusterRoleBindings referencing the gather service account and remove unexpected subjects

Patch Information

Refer to the Red Hat CVE-2026-93017 Advisory and Red Hat Bug Report #2515741 for the authoritative list of fixed OpenShift versions and errata identifiers. Updated manifests scope secret access with resourceNames or namespace restrictions.

Workarounds

Edit the insights-operator-gather ClusterRole to replace the broad secrets rule with a narrower rule using resourceNames for only the specific secrets the operator must read
Apply a NetworkPolicy to restrict egress from the insights-operator namespace, limiting the value of stolen credentials
Rotate all cluster secrets, kubeconfig entries, and integration tokens if audit logs show unauthorized access via the gather service account

bash

# Example: inspect the ClusterRole and its bindings
oc get clusterrole insights-operator-gather -o yaml
oc get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name=="insights-operator-gather")'

# Audit recent secret reads by the gather service account
oc adm node-logs --role=master --path=kube-apiserver/audit.log | \
  grep '"user":{"username":"system:serviceaccount:openshift-insights:gather"' | \
  grep '"resource":"secrets"'