📄 Description (English)
ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace principal with the stock `view` ClusterRole cannot directly read Secrets, but can read `InfraEnv` objects and recover the referenced Secret's `.dockerconfigjson` data from status.
This bypasses the Kubernetes/OpenShift RBAC separation between read-only namespace viewers and Secret readers. In the reproduced proof, the same ServiceAccount was denied `get` and `list` on Secrets, but recovered synthetic pull-secret `username`, `password`, `email`, and base64 `auth` fields through `InfraEnv.status`.
🤖 AI Executive Summary
CVE-2026-10101 is a privilege escalation vulnerability in ACM/MCE that leaks sensitive pull-secret credentials in InfraEnv status messages, allowing namespace viewers to bypass RBAC restrictions and recover Docker registry authentication data. With a CVSS score of 6.3 and no patch currently available, this poses a moderate but immediate risk to Kubernetes/OpenShift environments managing container registries. The vulnerability affects any organization using assisted-service for infrastructure provisioning where pull-secrets contain sensitive credentials.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 30, 2026 10:20
🇸🇦 Saudi Arabia Impact Assessment
Saudi organizations operating OpenShift/Kubernetes clusters for container orchestration are at risk, particularly: (1) Banking sector (SAMA-regulated) using ACM for infrastructure management and private container registries; (2) Government entities (NCA oversight) deploying assisted-service for cloud infrastructure; (3) Telecom operators (STC, Mobily) managing containerized services; (4) Energy sector (ARAMCO, SEC) running critical infrastructure on Kubernetes. The vulnerability allows low-privileged users (with only 'view' ClusterRole) to extract registry credentials, potentially leading to unauthorized access to proprietary container images, supply chain compromise, and lateral movement within container ecosystems.
🏢 Affected Saudi Sectors
Banking and Financial Services
Government and Public Administration
Telecommunications
Energy and Utilities
Healthcare
Cloud Service Providers
Container Registry Operators
🎯 MITRE ATT&CK Techniques
T1526 - Gather victim identity information (credential exposure)
T1087 - Account discovery (RBAC bypass)
T1552 - Unsecured credentials (status message exposure)
T1078 - Valid accounts (privilege escalation via RBAC bypass)
T1555 - Credentials from password stores (Kubernetes Secrets bypass)
T1021 - Remote services (lateral movement via exposed registry credentials)
⚖️ Saudi Risk Score (AI)
6.8
/ 10.0
🔧 Remediation Steps (English)
Immediate Actions:
1. Audit all InfraEnv objects in production clusters for exposed credentials in status.conditions[].message fields
2. Rotate all pull-secret credentials (registry usernames, passwords, auth tokens) that may have been exposed
3. Review RBAC policies to identify ServiceAccounts with 'view' ClusterRole access to InfraEnv objects
4. Implement network segmentation to restrict access to InfraEnv API endpoints
Compensating Controls (until patch available):
1. Restrict 'view' ClusterRole binding to trusted principals only; use custom roles without InfraEnv read permissions for standard users
2. Implement Pod Security Policies to prevent containers from accessing Kubernetes API
3. Enable audit logging for all InfraEnv object reads and status field access
4. Use external secret management (HashiCorp Vault, AWS Secrets Manager) instead of Kubernetes Secrets for pull-credentials
5. Implement NetworkPolicies to restrict egress from pods to container registries
Detection Rules:
1. Monitor for InfraEnv.status.conditions[].message containing base64-encoded auth patterns (eyJ or similar)
2. Alert on 'view' role users accessing InfraEnv objects followed by registry authentication attempts
3. Track pull-secret rotation events and compare with InfraEnv status timestamps
4. Monitor API audit logs for InfraEnv GET/LIST operations by low-privileged accounts
Patching Guidance:
1. Subscribe to Red Hat security advisories for ACM/MCE patches
2. Test patches in non-production environments before deployment
3. Plan cluster maintenance windows for ACM/MCE component updates
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع كائنات InfraEnv في المجموعات الإنتاجية للبحث عن بيانات اعتماد مكشوفة في حقول status.conditions[].message
2. تدوير جميع بيانات اعتماد pull-secret (أسماء المستخدمين والكلمات المرورية وتوكنات المصادقة) التي قد تكون مكشوفة
3. مراجعة سياسات RBAC لتحديد حسابات الخدمة التي تحتوي على وصول 'view' ClusterRole إلى كائنات InfraEnv
4. تنفيذ تقسيم الشبكة لتقييد الوصول إلى نقاط نهاية API الخاصة بـ InfraEnv
الضوابط التعويضية (حتى توفر التصحيح):
1. تقييد ربط 'view' ClusterRole للمبادئ الموثوقة فقط؛ استخدام أدوار مخصصة بدون أذونات قراءة InfraEnv للمستخدمين العاديين
2. تنفيذ سياسات أمان الحاويات لمنع الحاويات من الوصول إلى Kubernetes API
3. تفعيل تسجيل التدقيق لجميع عمليات قراءة كائنات InfraEnv والوصول إلى حقول الحالة
4. استخدام إدارة الأسرار الخارجية (HashiCorp Vault، AWS Secrets Manager) بدلاً من Kubernetes Secrets لبيانات اعتماد pull
5. تنفيذ NetworkPolicies لتقييد الخروج من الحاويات إلى سجلات الحاويات
قواعد الكشف:
1. مراقبة InfraEnv.status.conditions[].message التي تحتوي على أنماط مصادقة مشفرة بـ base64 (eyJ أو ما شابه)
2. تنبيه عند وصول مستخدمي دور 'view' إلى كائنات InfraEnv متبوعة بمحاولات مصادقة السجل
3. تتبع أحداث تدوير pull-secret ومقارنتها مع طوابع زمن حالة InfraEnv
4. مراقبة سجلات تدقيق API لعمليات InfraEnv GET/LIST من قبل الحسابات منخفضة الامتيازات
إرشادات التصحيح:
1. الاشتراك في استشارات أمان Red Hat لتصحيحات ACM/MCE
2. اختبار التصحيحات في بيئات غير الإنتاج قبل النشر
3. التخطيط لنوافذ صيانة المجموعات لتحديثات مكونات ACM/MCE
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.9.2.1 - User access management and RBAC enforcement
ECC 2024 A.8.2.3 - Cryptographic controls for sensitive data (credentials)
ECC 2024 A.12.4.1 - Event logging and monitoring of access to sensitive resources
🔵 SAMA CSF
SAMA CSF ID.AM-2 - Asset inventory and management
SAMA CSF PR.AC-1 - Access control policies and procedures
SAMA CSF DE.CM-1 - System monitoring and anomaly detection
SAMA CSF RC.IM-1 - Incident response and recovery procedures
🟡 ISO 27001:2022
ISO 27001:2022 A.5.3 - Segregation of duties
ISO 27001:2022 A.8.2.1 - User registration and access rights management
ISO 27001:2022 A.8.3.2 - User access provisioning
ISO 27001:2022 A.9.2.1 - User access management
ISO 27001:2022 A.9.4.3 - Password management
ISO 27001:2022 A.12.4.1 - Event logging
🟣 PCI DSS v4.0.1
PCI DSS 2.1 - Restrict access to system components by business need
PCI DSS 7.1 - Limit access to system components by business need-to-know
PCI DSS 8.2.3 - Passwords must meet minimum strength requirements
PCI DSS 10.2 - Implement automated audit trails for access to cardholder data