The ACM must-gather tool collects certain ACM "wrapper" Custom Resources that embed Secret data (credentials, tokens) without applying redaction. When an administrator runs must-gather for troubleshooting, these secrets are captured in cleartext in the must-gather archive. Archives are routinely uploaded to support cases, exposing credentials to anyone with access to the archive.

Source: Project Glasswing AI-SAST audit of stolostron/must-gather. Jira: ACM-38732 Remediation: Fix branch glasswing/f001/embedded-secret-data-in-acm-wrapper-crs (commit 2f863307b468), checkspassed. Reporter: Justin Kulikauskas