CVE-2026-73834: Cleartext Storage of Sensitive Information in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

A flaw in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes 2.11 causes sensitive information such as credentials and tokens embedded in ACM wrapper Custom Resources to be collected without redaction. When an administrator runs must-gather, these secrets are stored in cleartext within the resulting archive, potentially exposing sensitive data to unauthorized users who can access the archive. The vulnerability is identified as CVE-2026-73834 and has a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

The vulnerability allows exposure of sensitive credentials and tokens in cleartext within must-gather archives. This could lead to unauthorized disclosure of sensitive information if the archive is accessed by unauthorized parties. There is no indication of integrity or availability impact. Exploitation requires local access with privileges to run must-gather.

Red Hat has released security updates addressing this vulnerability in later versions of Red Hat Advanced Cluster Management for Kubernetes, specifically in the 2.17 release series. Users should apply the official security updates as documented in Red Hat advisories RHSA-2026:60386 and RHSA-2026:60387. Before applying updates, ensure all previously released errata relevant to your system are applied. Patch status is confirmed by Red Hat advisories. No additional mitigation steps are indicated beyond applying the official updates.