CVE-2026-75485: Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.
Affected Software
Event History
Frequently Asked Questions
Who could obtain the exposed credentials?
Users or systems that can access a must-gather archive are exposed because the archive may contain proxy basic-auth credentials in raw form. The issue is limited to credentials present in the cluster Proxy object collected by must-gather.
What access is needed to exploit this issue?
An attacker needs access to a must-gather archive containing the raw cluster Proxy object. No remote interaction is indicated by the provided severity vector; the vector specifies local access and low privileges.
What can be done to reduce exposure before a fix is applied?
If patching cannot happen immediately, restrict access to must-gather archives and treat existing archives that include the cluster Proxy object as potentially containing proxy basic-auth credentials. Avoid distributing those archives to people or systems that do not need access.
How can I determine whether an existing archive is affected?
Review must-gather archives for raw cluster Proxy object data and determine whether proxy basic-auth credentials are present. Archives with such credentials should be handled as sensitive authentication material.