CVE-2026-73834 is a medium-severity vulnerability affecting the must-gather tool in Red Hat Advanced Cluster Management for Kubernetes 2.11. The flaw causes certain ACM wrapper Custom Resources embedding Secret data to be collected without redaction, resulting in credentials and tokens being stored in cleartext within the must-gather archive. This archive may be shared or stored externally, increasing the risk of sensitive information disclosure. The vulnerability requires local access and low privileges but no user interaction. Red Hat has not released an official fix or patch for this issue, citing challenges with ease of use, deployment, and stability. The CVSS v3.1 score is 5.5 (medium), with a high confidentiality impact but no integrity or availability impact.

The vulnerability exposes sensitive credentials and tokens in cleartext within must-gather archives generated by administrators. Anyone with access to these archives can obtain confidential information, potentially leading to unauthorized access or further compromise. However, exploitation requires local access and cluster privileges to run must-gather. There is no impact on data integrity or system availability.

Currently, no official fix or patch is available for this vulnerability that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Administrators should exercise caution when sharing or storing must-gather archives, ensuring that access is strictly controlled and archives are handled securely. Monitoring and restricting access to these archives is recommended to reduce the risk of sensitive data exposure. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance. Upgrading to later versions beyond 2.11 may provide indirect mitigation if those versions include updated must-gather behavior, but no explicit fix is documented.