CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users
Assisted-service leaks pull-secret contents in InfraEnv status, allowing namespace viewers to bypass RBAC and read sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-10101?
CVE-2026-10101 is a medium-severity vulnerability in Red Hat Multicluster Engine for Kubernetes, published on 29 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace principal with the stock `view` ClusterRole cannot directly read Secrets, but can read `InfraEnv` objects and recover the referenced Secret's `.dockerconfigjson` data from status.
This bypasses the Kubernetes/OpenShift RBAC separation between read-only namespace viewers and Secret readers. In the reproduced proof, the same ServiceAccount was denied `get` and `list` on Secrets, but recovered synthetic pull-secret `username`, `password`, `email`, and base64 `auth` fields through `InfraEnv.status`.
Weakness: CWE-201
Which versions are affected by CVE-2026-10101?
How do I fix CVE-2026-10101?
No fix has been published for CVE-2026-10101 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-10101 being exploited?
There is no known exploitation of CVE-2026-10101 in the wild and no public exploit code.
Sources
Also known as GHSA-jxxw-7x7w-4x47.