Description

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-18T16:18:20.743Z",
  "pubdate": "2026-08-18T16:18:20.743Z",
  "executiveSummary": "A credential exposure vulnerability exists within the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The flaw involves the insecure handling of the cluster Proxy object, which is dumped in raw, unredacted form during diagnostic data collection. This behavior bypasses the standard oc inspect redaction mechanisms designed to sanitize sensitive parameters. Consequently, proxy basic-auth credentials are inadvertently written into the resulting must-gather archive in plaintext. The impact of this vulnerability includes the potential disclosure of sensitive authentication material to any internal user, administrator, or third party who gains unauthorized or authorized access to the generated diagnostic archive files. Affected systems comprise Red Hat Advanced Cluster Management for Kubernetes deployments utilizing the vulnerable must-gather component. The risk implications center around credential compromise, potentially enabling lateral movement, unauthorized access to proxy resources, or further compromise of integrated cluster services. Attack capabilities require an actor to obtain access to the must-gather diagnostic archive containing the plaintext credentials. Exploitation requirements mandate that a must-gather operation has been executed and that the resulting archive is exposed or inadequately protected in storage.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of data sanitization logic within the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. During the diagnostic collection process, the cluster Proxy object is serialized and written to the output archive in its raw form. Standard security routines, specifically the oc inspect redaction frameworks intended to mask or strip sensitive fields such as authentication tokens, passwords, and basic-auth credentials, are bypassed entirely for this specific object. The vulnerable component is the diagnostic must-gather utility responsible for aggregating cluster state and configuration data. When the must-gather command is executed, the utility queries the Kubernetes API server for cluster resources, including the Proxy configuration. While other components correctly enforce redaction policies, the Proxy object handling lacks this validation layer, causing sensitive basic-auth credentials embedded within the configuration to be captured verbatim. Exploitation occurs passively through the generation and subsequent exposure of the diagnostic archive. The attack flow begins with the execution of the must-gather tool, which extracts the unredacted cluster Proxy object containing plaintext credentials into the artifact directory. Once the archive is compiled, any entity with read access to the file system, object storage bucket, or ticketing system where the archive is uploaded can extract the payload and retrieve the cleartext basic-auth credentials. Authentication and privilege requirements for exploitation depend entirely on access control mechanisms governing the must-gather archive itself, rather than the initial API query, as the sensitive data is stored statically within the artifact. The network exposure is limited to the storage vectors housing the diagnostic bundle. Post-exploitation impact involves the reuse of the harvested proxy basic-auth credentials to authenticate against upstream proxies or protected network endpoints, potentially granting unauthorized access to external networks, internal services, or auxiliary cluster infrastructure managed through the compromised proxy."
}