CVE-2026-10101

Red Hat statement

Red Hat rates this flaw as Moderate impact. Exploitation requires a namespace "view" user to be in a namespace where an InfraEnv references a pull secret that fails assisted-service validation -- a condition the "view" user cannot trigger themselves. Red Hat scores UI:R (User Interaction Required) because the leak only exists when an administrator creates or updates an InfraEnv referencing a pull secret that fails validation; without that admin action, there is nothing to exploit. The direct impact is confidentiality: the full pull-secret content is disclosed through InfraEnv status, bypassing the Kubernetes RBAC boundary that prevents "view" users from reading Secrets. Red Hat scores I:L (Integrity: Low) rather than I:H because, with Scope: Unchanged, integrity impact should reflect the vulnerable component (MCE/ACM), not external registries. The leaked credential's write capability is conditional on the specific credential's permissions and does not represent integrity compromise of the ACM/MCE cluster itself.