REDHAT-BUG-2517904: Medium severity stolostron/must-gather vulnerability
The ACM must-gather tool collects certain ACM "wrapper" Custom Resources that embed Secret data (credentials, tokens) without applying redaction. When an administrator runs must-gather for troubleshooting, these secrets are captured in cleartext in the must-gather archive. Archives are routinely uploaded to support cases, exposing credentials to anyone with access to the archive.
Source: Project Glasswing AI-SAST audit of stolostron/must-gather. Jira: ACM-38732 Remediation: Fix branch glasswing/f001/embedded-secret-data-in-acm-wrapper-crs (commit 2f863307b468), checkspassed. Reporter: Justin Kulikauskas
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stolostron/must-gather (Project Glasswing AI-SAST audit)to a version that resolves this vulnerability.Patch ACM-38732 - Upgrade
Upgrade
glasswing/f001/embedded-secret-data-in-acm-wrapper-crsto a version that resolves this vulnerability.Fixed in 2f863307b468
Event History
Frequently Asked Questions
Who can access the exposed credentials?
Administrators who run the ACM must-gather tool are exposed because the affected collection includes ACM wrapper Custom Resources containing embedded credentials or tokens. Anyone who can access the resulting archive, including support-case participants, may be able to view those secrets.
What access is required to obtain the secrets?
An attacker does not need to exploit a running service. They need access to a must-gather archive created by an administrator and containing the unredacted wrapper Custom Resources.
What can be done if the remediation cannot be applied immediately?
Avoid broadly sharing affected must-gather archives and treat existing archives as sensitive because they may contain cleartext credentials and tokens. Access to uploaded support archives should be restricted to authorized personnel.