CVE-2026-71846

Name of the Vulnerable Software and Affected Versions insights-client (affected versions not specified)

Description A flaw exists where the ServiceAccount of the component is bound to a ClusterRole that grants cluster-wide permissions to get, list, and watch secrets, exceeding the actual requirements of the code which only needs access to one specific Secret. This excessive privilege allows an attacker who compromises the insights-client pod or its ServiceAccount token to read all Secrets across the hub cluster, including sensitive credentials and managed-cluster kubeconfigs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.