CVE-2026-71845
published 2026-08-11CVE-2026-71845: A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer…
PriorityP347high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.50%
42.1th percentile
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | advanced_cluster_management_for_kubernetes | — | — |
| rhacm2 | insights-client-rhel9 | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
insights-client: insights-client: CCX_TOKEN bearer credential logged in clear text at startup via setDefault()
vendor_redhat·2026-08-11·CVSS 6.3
CVE-2026-71845 [MEDIUM] CWE-532 insights-client: insights-client: CCX_TOKEN bearer credential logged in clear text at startup via setDefault()
insights-client: insights-client: CCX_TOKEN bearer credential logged in clear text at startup via setDefault()
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.
Statement: This is a Moderate flaw in Red Hat Advanced Cluster Management for Kubernetes. The insights-client component logs the CCX_TOKEN bearer credential in clear text at startup when glog verbosity is set to level 2 or higher.
GHSA
A flaw was found in insights-client.
ghsa_unreviewed·2026-08-11
CVE-2026-71845 [MEDIUM] CWE-532 A flaw was found in insights-client.
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71845 insights-client: CVE-2026-71845 insights-client: CCX_TOKEN bearer credential logged in clear text at startup via setDefault()
bugzilla·2026-08-07·CVSS 6.3
CVE-2026-71845 [MEDIUM] CVE-2026-71845 insights-client: CVE-2026-71845 insights-client: CCX_TOKEN bearer credential logged in clear text at startup via setDefault()
CVE-2026-71845 insights-client: CVE-2026-71845 insights-client: CCX_TOKEN bearer credential logged in clear text at startup via setDefault()
The setDefault() function in pkg/config/config.go logs every environment variable it consumes via glog.V(2).Infof("Using %s from environment: %s", env, val), including CCX_TOKEN — a bearer credential used by disconnected clusters as an alternative to cloud.redhat.com (which is unreachable from their environments). At -v>=2 verbosity, the token is printed in clear text to the pod log on every startup. The credential is then accessible to any principal with pods/log access in the open-cluster-management namespace or access to centralized logging (Loki/Elasticsearch), crossing a privilege boundary since log readers typically do not have secrets access t
Bugzilla
CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
bugzilla·2026-08-07·CVSS 6.3
CVE-2026-71846 [MEDIUM] CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
CVE-2026-71846 insights-client: CVE-2026-71846 insights-client: ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
The insights-client ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get/list/watch. The code only requires access to a single Secret — openshift-config/pull-secret (pkg/retriever/reportretriever.go:111-112, StartTokenRefresh). The over-broad RBAC means a compromise of the insights-client pod or ServiceAccount token grants read access to every Secret on the hub cluster, including managed-cluster kubeconfigs, ArgoCD/GitOps credentials, and other addon tokens. This significantly amplifies the impact of any code execution or credential theft vulnerability in insights-client (e.g., CVE-2026-71474, CVE-2026-71845).
The production C
https://access.redhat.com/errata/RHSA-2026:60386https://access.redhat.com/errata/RHSA-2026:60387https://access.redhat.com/errata/RHSA-2026:60388https://access.redhat.com/errata/RHSA-2026:60389https://access.redhat.com/errata/RHSA-2026:60390https://access.redhat.com/errata/RHSA-2026:60391https://access.redhat.com/security/cve/CVE-2026-71845https://bugzilla.redhat.com/show_bug.cgi?id=2512568
2026-08-11
Published