CVE-2026-73834CWE-312

CVE-2026-73834

Medium · published August 18, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00111 · 1.2th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-08-18T20:18Z
References (8)
https://access.redhat.com/errata/RHSA-2026:60386 · [email protected]https://access.redhat.com/errata/RHSA-2026:60387 · [email protected]https://access.redhat.com/errata/RHSA-2026:60388 · [email protected]https://access.redhat.com/errata/RHSA-2026:60389 · [email protected]https://access.redhat.com/errata/RHSA-2026:60390 · [email protected]https://access.redhat.com/errata/RHSA-2026:60391 · [email protected]https://access.redhat.com/security/cve/CVE-2026-73834 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2517904 · [email protected]
EPSS history
Timeline
  • 18 AUG 15:15Z
    Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
    cvelistv5