CVE-2026-73834: Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.
Other sources
The ACM must-gather tool collects certain ACM "wrapper" Custom Resources that embed Secret data (credentials, tokens) without applying redaction. When an administrator runs must-gather for troubleshooting, these secrets are captured in cleartext in the must-gather archive. Archives are routinely uploaded to support cases, exposing credentials to anyone with access to the archive.
Source: Project Glasswing AI-SAST audit of stolostron/must-gather. Jira: ACM-38732 Remediation: Fix branch glasswing/f001/embedded-secret-data-in-acm-wrapper-crs (commit 2f863307b468), checkspassed. Reporter: Justin Kulikauskas
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat Advanced Cluster Management for Kubernetes must-gatherto a version that resolves this vulnerability.Patch ACM-38732 - Upgrade
Upgrade
must-gatherto a version that resolves this vulnerability.Patch commit 2f863307b468 - Operational
Ensure the must-gather fix branch glasswing/f001/embedded-secret-data-in-acm-wrapper-crs (commit 2f863307b468, checks_passed) is applied so embedded Secret data in ACM wrapper Custom Resources is not collected without redaction.
- Operational
Because must-gather archives captured credentials/tokens in cleartext, rotate any credentials and tokens that may have been exposed in previously generated must-gather archives.
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Organizations that run the ACM must-gather tool and collect the affected ACM wrapper Custom Resources are exposed. The practical exposure is greatest when generated archives are shared with support personnel or any other parties who can access the archive.
What must occur for sensitive data to be exposed?
An administrator must run must-gather, causing credentials or tokens embedded in certain ACM wrapper Custom Resources to be written in cleartext to the output archive. An attacker or unauthorized party then needs access to that archive; no direct cluster access is described as necessary at that stage.
What should teams do if they cannot immediately apply the remediation?
Treat existing must-gather archives as potentially containing unredacted credentials or tokens, especially archives uploaded to support cases. Restrict access to those archives and handle any embedded credentials or tokens as potentially exposed.
How can an organization determine whether it may already be affected?
Review must-gather archives produced for ACM troubleshooting for collected ACM wrapper Custom Resources that embed Secret data. If such resources were collected, the archive may contain their credentials or tokens in cleartext.