Skip to content
fr Sign in
6.8 Medium

CVE-2026-71475 A flaw was found in insights-client

Description

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259125 earliest → < 1787259125 1787259125
Red Hat Advanced Cluster Management for Kubernetes 2.14 1786882244 earliest → < 1786882244 1786882244
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238585 earliest → < 1787238585 1787238585
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787184541 earliest → < 1787184541 1787184541
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787227689 earliest → < 1787227689 1787227689
Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1786882244 earliest → < 1786882244 1786882244

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE