Skip to content
fr Sign in
7.1 High

CVE-2026-71474 A flaw was found in insights-client

Description

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787688993 earliest → < 1787688993 1787688993
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259125 earliest → < 1787259125 1787259125
Red Hat Advanced Cluster Management for Kubernetes 2.14 1786882244 earliest → < 1786882244 1786882244
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238585 earliest → < 1787238585 1787238585
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787184541 earliest → < 1787184541 1787184541
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787227689 earliest → < 1787227689 1787227689
Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1786882244 earliest → < 1786882244 1786882244

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE