CVE-2026-71846: Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Other sources
The insights-client ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get/list/watch. The code only requires access to a single Secret — openshift-config/pull-secret (pkg/retriever/reportretriever.go:111-112, StartTokenRefresh). The over-broad RBAC means a compromise of the insights-client pod or ServiceAccount token grants read access to every Secret on the hub cluster, including managed-cluster kubeconfigs, ArgoCD/GitOps credentials, and other addon tokens. This significantly amplifies the impact of any code execution or credential theft vulnerability in insights-client (e.g., CVE-2026-71474, CVE-2026-71845).
The production ClusterRole should be scoped to the minimum required: get on the specific Secret openshift-config/pull-secret in the openshift-config namespace, rather than cluster-wide secrets access.
Upstream: stolostron/insights-client
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the production ClusterRole bound to the insights-client ServiceAccount to remove cluster-wide secrets get/list/watch. Grant only the minimum required permission: get on Secret openshift-config/pull-secret in the openshift-config namespace, since the code only requires that single Secret (StartTokenRefresh in pkg/retriever/reportretriever.go:111-112).
insights-client ServiceAccount RBAC ClusterRole rules (secrets permissions) = Restrict from cluster-wide secrets get/list/watch to get on the single Secret openshift-config/pull-secret
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71846?
CVE-2026-71846 has a medium severity score of 6.5.
How do I fix CVE-2026-71846?
To fix CVE-2026-71846, you should modify the ClusterRole bindings for the insights-client to limit permissions to only the required Secret.
What are the potential risks of CVE-2026-71846?
The potential risks of CVE-2026-71846 include unauthorized access to cluster-wide secrets if the insights-client pod is compromised.
What components are affected by CVE-2026-71846?
CVE-2026-71846 affects the insights-client component due to its excessive permissions granted through its ServiceAccount.
Is there a workaround for CVE-2026-71846?
A potential workaround for CVE-2026-71846 is to adjust the permissions of the ServiceAccount associated with insights-client until an official fix is implemented.