THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-71846 (MEDIUM 6.5) — A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the i

[NVD] CVE-2026-71846 (MEDIUM 6.5) — A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the i

mednvdPublished 2026-08-12

CVE-2026-71846 CVSS: 6.5 MEDIUM Published: 2026-08-12T22:17:16.143

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would gra

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-71846cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-71846