CVE-2026-71474
INFO
Priority: 0.00
BB Relevance:
0/100
Published: 2026-08-11
Modified: 2026-10-24
First seen: 2026-10-29
Status: pending_score
Description
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| redhat | advanced_cluster_management_for_kubernetes | 2.0 |
| redhat | insights-client | - |
References & Advisories (8)
Vendor Advisory
Issue Tracking
Vendor Advisory