CVE-2026-75485

Published: Aug 18, 2026Modified: Aug 26, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (5)

https://access.redhat.com/errata/RHSA-2026:60386

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60389

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60390

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-75485

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2517905

Source: secalert@redhat.com

Timeline

No history available yet.