Security readout for executives and security teams
Plain-English summary
CVE-2026-10101 lets a read-only namespace user in Red Hat Multicluster Engine assisted-service recover pull-secret contents indirectly from InfraEnv status messages after validation failures. This undermines expected Kubernetes/OpenShift RBAC separation because users who cannot read Secrets may still see secret data exposed in a readable custom resource status.
Executive priority
Treat as a targeted credential exposure issue, not a broad remote compromise. Prioritize clusters where many users have namespace view access or where pull secrets provide registry access beyond one namespace. Rotate exposed credentials and monitor vendor guidance.
Technical view
Assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions[].message when pull-secret validation fails. Stock namespace view users can read InfraEnv objects but cannot directly get or list Secrets. The reported reproduction recovered .dockerconfigjson fields, including username, password, email, and auth, via InfraEnv status. CWE-201 applies.
Likely exposure
Exposure is limited to environments using Red Hat Multicluster Engine for Kubernetes with assisted-service InfraEnv resources and namespace principals granted view access. Impact depends on whether pull-secret validation failures occurred and whether status messages retained referenced Secret contents.
Exploitation context
The source bundle does not indicate active exploitation, and the CVE is not listed as KEV. Exploitation requires low privileges in the namespace and user interaction per CVSS. The practical risk is credential disclosure to users who were intentionally denied direct Secret access.
Researcher notes
The key control failure is secret material crossing from Secret storage into a readable status field. Validate RBAC assumptions around custom resource status visibility. Evidence in the bundle names multicluster-engine/assisted-service-9-rhel9 as affected but does not provide specific affected versions or a patch level.
Mitigation direction
- Check Red Hat advisory and Bugzilla for fixed versions or supported mitigations.
- Limit namespace view access where assisted-service InfraEnv objects reference sensitive pull secrets.
- Rotate any pull secrets suspected of exposure through InfraEnv status messages.
- Review automation that creates InfraEnv resources with invalid or failing pull-secret references.
Validation and detection
- Inventory Multicluster Engine assisted-service deployments and InfraEnv custom resources.
- Identify users or service accounts with namespace view access to affected namespaces.
- Inspect InfraEnv status messages for exposed pull-secret or dockerconfigjson-like content.
- Confirm whether referenced pull secrets have been rotated after any exposure.
- Track Red Hat CVE and Bugzilla updates for remediation guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-201: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-10101 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N2.14.2redhatVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2026-10101CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2483298CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.