CVE-2026-73834 is a medium-severity vulnerability affecting the must-gather tool in Red Hat Advanced Cluster Management for Kubernetes 2. The flaw causes certain ACM wrapper Custom Resources that embed Secret data to be collected without redaction during must-gather operations. As a result, credentials and tokens are captured in cleartext within the must-gather archive. This archive may be shared with support teams or stored externally, increasing the risk of information disclosure. The vulnerability requires local access and cluster privileges to exploit, with no user interaction needed. The confidentiality impact is high, but there is no impact on integrity or availability. Red Hat has not released a patch or official remediation and notes that available mitigations do not meet their criteria for ease of use, applicability, or stability.

The vulnerability exposes sensitive credentials and tokens in cleartext within must-gather archives, which can be accessed by anyone with access to these archives. This creates a significant confidentiality risk, potentially leading to unauthorized disclosure of sensitive information. However, exploitation requires local access and cluster privileges, limiting the attack vector. There is no impact on data integrity or system availability.

Red Hat currently does not provide an official fix or patch for this vulnerability. The vendor states that available mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should exercise caution when sharing or storing must-gather archives containing ACM wrapper Custom Resources with embedded Secret data, restricting access to trusted personnel only. Monitor Red Hat advisories for any future updates or patches.