CVE-2026-71474
published 2026-08-11CVE-2026-71474: A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com…
PriorityP431medium6.5CVSS 3.1
AVLACLPRLUINSCCHINAN
EPSS
0.16%
4.4th percentile
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | advanced_cluster_management_for_kubernetes | — | — |
| rhacm2 | insights-client-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in insights-client.
ghsa_unreviewed·2026-08-11
CVE-2026-71474 [MEDIUM] CWE-532 A flaw was found in insights-client.
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Red Hat
insights-client-rhel9: insights-client: Pull-secret bearer token written to logs on non-200 CCX response
vendor_redhat·2026-08-11·CVSS 6.3
CVE-2026-71474 [MEDIUM] CWE-532 insights-client-rhel9: insights-client: Pull-secret bearer token written to logs on non-200 CCX response
insights-client-rhel9: insights-client: Pull-secret bearer token written to logs on non-200 CCX response
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Statement: This Moderate flaw in insights-client can expose the cloud.openshift.com pull-secret token within pod logs on the hub. When the client receives a non-200 response and logs at verbosity level 3 or higher, the token is written to stderr/pod logs, making it accessible to principals with pods/log access. This data exposure is limited
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
bugzilla·2026-08-07·CVSS 6.3
CVE-2026-71846 [MEDIUM] CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
The insights-client ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get/list/watch. The code only requires access to a single Secret — openshift-config/pull-secret (pkg/retriever/reportretriever.go:111-112, StartTokenRefresh). The over-broad RBAC means a compromise of the insights-client pod or ServiceAccount token grants read access to every Secret on the hub cluster, including managed-cluster kubeconfigs, ArgoCD/GitOps credentials, and other addon tokens. This significantly amplifies the impact of any code execution or credential theft vulnerability in insights-client (e.g., CVE-2026-71474, CVE-2026-71845).
The production C
Bugzilla
CVE-2026-71474 insights-client-rhel9: CVE-2026-71474 insights-client: Pull-secret bearer token written to logs on non-200 CCX response
bugzilla·2026-08-06·CVSS 6.3
CVE-2026-71474 [MEDIUM] CVE-2026-71474 insights-client-rhel9: CVE-2026-71474 insights-client: Pull-secret bearer token written to logs on non-200 CCX response
CVE-2026-71474 insights-client-rhel9: CVE-2026-71474 insights-client: Pull-secret bearer token written to logs on non-200 CCX response
CreateInsightsRequest sets the Authorization header to "Bearer " + the cloud.openshift.com pull-secret token. In CallInsights, when the response status is not 200, the function logs the request headers at verbosity >= 3 via glog.V(3).Infof("Response header for report %v", req.Header), which writes the cluster's long-lived cloud.openshift.com pull-secret credential to stderr / pod logs. Pod logs on the hub are readable by any principal with pods/log access. The pull-secret is a long-lived credential that grants access to Red Hat cloud services.
Upstream: stolostron/insights-client
https://access.redhat.com/errata/RHSA-2026:60386https://access.redhat.com/errata/RHSA-2026:60387https://access.redhat.com/errata/RHSA-2026:60388https://access.redhat.com/errata/RHSA-2026:60389https://access.redhat.com/errata/RHSA-2026:60390https://access.redhat.com/errata/RHSA-2026:60391https://access.redhat.com/security/cve/CVE-2026-71474https://bugzilla.redhat.com/show_bug.cgi?id=2512153
2026-08-11
Published