REDHAT-BUG-2515741: High severity Red Hat Insights Operator vulnerability
Published Aug 13, 2026
·Updated
FIND-001 from Project Glasswing AI-SAST audit of openshift/insights-operator (audit date 2026-06-09, commit unknown). The insights-operator-gather ClusterRole, bound to ServiceAccount openshift-insights, grants cluster-wide get/list on secrets and nodes/proxy. While the operator gathers diagnostic data from the cluster, access to all secrets cluster-wide exceeds what is needed for telemetry collection.
Affected Software
1 affected component
Red Hat Insights Operator
Event History
Aug 13, 2026
Data Sourced
via Red Hat·09:22 PM
DescriptionSeverityAffected Software