CVE-2026-73834 MEDIUM

CVE-2026-73834: Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

Weakness CWE-312 · Cleartext storage
Published August 18, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.

Key dates

02Disclosure timeline

August 18, 2026 CVE published
August 27, 2026 Record updated