CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

Score
CVSS 3.1 7.1 High
Status
Modified - secalert@redhat.com
Published
2026-08-11
Last modified
2026-10-24
Weaknesses
CWE-532

Affected products

References

 
 
© AVABIS GmbH privacypolicy about