Red Hat ACM Must-Gather Flaw Exposes Kubernetes Secrets in Cleartext

A newly identified vulnerability, CVE-2026-73834, has been discovered in the `must-gather` component of Red Hat Advanced Cluster Management (ACM) for Kubernetes. This flaw specifically affects how certain ACM wrapper Custom Resources (CRs) that embed sensitive Secret data are handled during diagnostic collection. The core issue is that when an administrator executes the `must-gather` command, these embedded credentials and tokens are captured and stored in the resulting archive in cleartext, without any redaction. This means that diagnostic bundles, typically used for debugging and support, can inadvertently contain highly sensitive information like API keys, database passwords, or other authentication tokens. This vulnerability carries significant implications for any organization utilizing Red Hat ACM to manage their Kubernetes clusters, particularly those operating in regulated environments or handling sensitive data. The primary concern is data exposure: an attacker who gains access to a `must-gather` archive could potentially compromise entire Kubernetes environments or connected systems by extracting these cleartext secrets. This directly impacts security engineers, DevOps practitioners, and platform administrators responsible for maintaining the confidentiality and integrity of their cloud-native infrastructure. The ease with which an administrator can unknowingly create a high-risk data artifact underscores the need for immediate attention and remediation. This incident fits into a broader, well-established trend of supply chain and configuration-related vulnerabilities in complex cloud-native ecosystems. As Kubernetes environments grow in scale and complexity, the tools designed to manage and troubleshoot them often introduce new attack surfaces. The `must-gather` tool, while invaluable for diagnostics, exemplifies how seemingly innocuous functionalities can become security liabilities if not designed with a "security-by-default" mindset. This echoes concerns seen in other areas of container security, such as vulnerabilities in image registries or misconfigurations in CI/CD pipelines, where the focus has shifted from simple image scanning to contextual risk management across the entire lifecycle. The increasing sophistication of attacks targeting cloud-native infrastructure demands a continuous re-evaluation of all components, including administrative and diagnostic utilities. Practitioners using Red Hat ACM should prioritize reviewing their `must-gather` procedures immediately. The most critical action is to ensure that any `must-gather` archives are treated with the highest level of security, limiting access strictly to authorized personnel and encrypting them both in transit and at rest. Organizations should also investigate whether Red Hat has released a patch or a recommended mitigation strategy for CVE-2026-73834. In the interim, manual inspection and redaction of sensitive data from `must-gather` outputs should be considered a mandatory step before sharing these archives, even internally. This vulnerability serves as a stark reminder that security extends beyond runtime protection to every tool and process interacting with the Kubernetes control plane and its configurations.