Threats tagged 'ghsa-wfwr-qqxc-6cch'

A vulnerability in insights-client involves excessive permissions granted to its ServiceAccount, which is bound to a ClusterRole with cluster-wide read access to all Secrets. This over-privilege means that if the insights-client pod or its ServiceAccount token is compromised, an attacker could read all Secrets in the hub cluster, including sensitive credentials such as managed-cluster kubeconfigs.