CVE-2026-93017: Improper Privilege Management in Red Hat Red Hat OpenShift Container Platform 4

The vulnerability arises because the insights-operator-gather ClusterRole includes permissions to get and list secrets in the core API group without any namespace or resource name restrictions. This means the service account 'gather' can read every secret in every namespace. An attacker who can create a pod using this service account can exploit this to access sensitive secrets cluster-wide. The issue is documented in the insights-operator manifests and tracked as CVE-2026-93017.

An attacker with the ability to spawn a pod using the 'gather' service account can read all secrets in every namespace of the cluster. This can lead to disclosure of sensitive information stored in secrets, potentially compromising cluster security and confidentiality. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93017 for current remediation guidance. Until a fix is available, restrict the ability to spawn pods with the 'gather' service account or modify the ClusterRole to limit secret access scope.