PT-2026-44890 · Red Hat · Multicluster Engine For Kubernetes

Bzimport · CVE-2026-10101 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ACM/MCE assisted-service (affected versions not specified)

Description The assisted-service writes raw referenced pull-secret contents into the InfraEnv.status.conditions[].message field when pull-secret validation fails. This allows a namespace principal with the view ClusterRole to recover .dockerconfigjson data, including username, password, email, and base64 auth fields, by reading InfraEnv objects. This behavior bypasses the Kubernetes/OpenShift Role-Based Access Control (RBAC) separation between read-only namespace viewers and Secret readers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-10101

Affected Products

Multicluster Engine For Kubernetes

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-10101 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-10101 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2483298 · Note
• https://t.me/cveNotify/184897 · Telegram Post
• https://t.me/cveNotify/209132 · Telegram Post