CVE-2026-75485: Insertion of Sensitive Information into Log File in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability involves the must-gather component dumping the cluster Proxy object in raw form without applying the usual oc inspect redaction that sanitizes sensitive fields. As a result, proxy basic-auth credentials are included in the must-gather archive, potentially exposing sensitive authentication data to anyone with access to the archive. This issue affects Red Hat Advanced Cluster Management for Kubernetes version 2.11. The CVSS v3.1 base score is 5.5 (medium severity), with an attack vector of local, low complexity, requiring low privileges and no user interaction, and impacts confidentiality but not integrity or availability.

Exposure of proxy basic-auth credentials in the must-gather archive can lead to unauthorized disclosure of sensitive authentication information. This could compromise the security of the Kubernetes cluster management environment if the archive is accessed by unauthorized parties. The impact is limited to confidentiality and does not affect integrity or availability.

Red Hat has issued security advisories (RHSA-2026:60387) for Red Hat Advanced Cluster Management for Kubernetes 2.11 that include updated container images addressing this and other vulnerabilities. Users should apply the security update to version 2.11.11 or later as recommended by Red Hat. Before applying the update, ensure all previously released relevant errata are applied. Refer to Red Hat's official guidance for update procedures. No indication exists that the vulnerability is mitigated without applying the update.