QSearchQSearch

CVE-2026-10101

6.3 MEDIUM

ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validati...

Published: 2026-05-29 · Last updated: 2026-05-29

Severity and scoring

CVSS
6.3 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CWE
CWE-201

Description

ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace principal with the stock `view` ClusterRole cannot directly read Secrets, but can read `InfraEnv` objects and recover the referenced Secret's `.dockerconfigjson` data from status. This bypasses the Kubernetes/OpenShift RBAC separation between read-only namespace viewers and Secret readers. In the reproduced proof, the same ServiceAccount was denied `get` and `list` on Secrets, but recovered synthetic pull-secret `username`, `password`, `email`, and base64 `auth` fields through `InfraEnv.status`.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-52695 — Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions (7.5 HIGH)
  • CVE-2026-52692 — Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions (7.5 HIGH)
  • CVE-2026-49082 — Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; C... (7.4 HIGH)
  • CVE-2026-48965 — Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions (6.5 MEDIUM)
  • CVE-2026-42667 — Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions (7.5 HIGH)