PT-2026-44890 · Red Hat · Multicluster Engine For Kubernetes

Bzimport · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-10101

NVD

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions[].message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's .dockerconfigjson data from status.

This bypasses the Kubernetes/OpenShift RBAC separation between read-only namespace viewers and Secret readers. In the reproduced proof, the same ServiceAccount was denied get and list on Secrets, but recovered synthetic pull-secret username, password, email, and base64 auth fields through InfraEnv.status.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-10101

Affected Products

Multicluster Engine For Kubernetes

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-10101 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2483298 · Note
• https://access.redhat.com/security/cve/CVE-2026-10101 · Note