CVE-2026-71846
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Aug 12, 2026
CISA due date
—
The record
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79942 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-250
- CVE-2026-87506 Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-250
- CVE-2026-69464 Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized… CWE-250
- CVE-2026-69409 Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized… CWE-250
- CVE-2026-80238 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-250
- CVE-2026-83534 PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel()… CWE-250
- CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature… CWE-250
- CVE-2026-70496 A flaw was found in search-v2-operator. CWE-250