REDHAT-BUG-2512569: Medium severity stolostron/insights-client vulnerability
The insights-client ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get/list/watch. The code only requires access to a single Secret — openshift-config/pull-secret (pkg/retriever/reportretriever.go:111-112, StartTokenRefresh). The over-broad RBAC means a compromise of the insights-client pod or ServiceAccount token grants read access to every Secret on the hub cluster, including managed-cluster kubeconfigs, ArgoCD/GitOps credentials, and other addon tokens. This significantly amplifies the impact of any code execution or credential theft vulnerability in insights-client (e.g., CVE-2026-71474, CVE-2026-71845).
The production ClusterRole should be scoped to the minimum required: get on the specific Secret openshift-config/pull-secret in the openshift-config namespace, rather than cluster-wide secrets access.
Upstream: stolostron/insights-client
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Scope the production ClusterRole bound to the insights-client ServiceAccount: remove cluster-wide access to secrets (get/list/watch across all namespaces) and instead grant only the minimal permissions to read the single required Secret openshift-config/pull-secret in the openshift-config namespace (i.e., allow 'get' on that specific Secret, not cluster-wide secrets access).
OpenShift RBAC (ClusterRole for insights-client ServiceAccount) verbs/resources scope for secrets = Replace cluster-wide secrets get/list/watch with namespace-scoped get on openshift-config/pull-secret only
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512569?
The severity of REDHAT-BUG-2512569 is medium, rated at 4.
How do I fix REDHAT-BUG-2512569?
To fix REDHAT-BUG-2512569, you should limit the permissions of the insights-client ServiceAccount to only access the required Secret.
What is the risk associated with REDHAT-BUG-2512569?
The risk associated with REDHAT-BUG-2512569 involves the potential for compromise due to over-broad RBAC permissions allowing access to cluster-wide secrets.
What is the main issue described in REDHAT-BUG-2512569?
The main issue described in REDHAT-BUG-2512569 is that the insights-client ServiceAccount is granted excessive permissions through a ClusterRole.
What should users of stolostron/insights-client be aware of regarding REDHAT-BUG-2512569?
Users of stolostron/insights-client should be aware that the current RBAC configuration poses a security risk due to unnecessary access to secrets.