The insights-client component's ServiceAccount is bound to a ClusterRole that grants cluster-wide permissions to get, list, and watch all Secrets. However, the component only needs access to a specific Secret (openshift-config/pull-secret). This excessive privilege creates a privilege amplification vulnerability (CWE-250), allowing an attacker who compromises the insights-client pod or its ServiceAccount token to read all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials. The vulnerability is rated moderate with a CVSS 3.1 score of 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). No known exploits in the wild have been reported. The vendor advisory from Red Hat recommends restricting the ClusterRole to the minimum required permissions by replacing cluster-wide secrets get/list/watch with a namespaced Role granting get access only to the specific Secret in the openshift-config namespace.

An attacker who gains control over the insights-client pod or its ServiceAccount token can read all Kubernetes Secrets across the hub cluster. This includes sensitive credentials such as managed-cluster kubeconfigs, potentially leading to further cluster compromise or unauthorized access to sensitive data. The vulnerability does not affect integrity or availability but has a high confidentiality impact.

Red Hat advises restricting the insights-client ClusterRole to the minimum necessary permissions. Specifically, replace the cluster-wide secrets get/list/watch permissions with a namespaced Role that grants get access only to the specific Secret openshift-config/pull-secret in the openshift-config namespace. This reduces the attack surface by enforcing least privilege. No official patch version or update is currently stated; users should apply this RBAC restriction as a mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.