Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2026-71475 A flaw was found in insights-client

Description

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Advanced Cluster Management for Kubernetes 2 Versions non publiées
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787259125 premières → < 1787259125 1787259125
Red Hat Advanced Cluster Management for Kubernetes 2.14 1786882244 premières → < 1786882244 1786882244
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238585 premières → < 1787238585 1787238585
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787184541 premières → < 1787184541 1787184541
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787227689 premières → < 1787227689 1787227689
Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1786882244 premières → < 1786882244 1786882244

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Advanced Cluster Management for Kubernetes 2

Les 121 CVE de Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Moyenne CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 Élevée CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 Élevée CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Moyenne
Suivre cette CVE