CVE-2026-71474
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In insights-client, when a non-200 response is received, request headers are logged, which may include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Risk Assessment
Disclosure of a long-lived token could lead to unauthorized access to Red Hat cloud services, potentially compromising data confidentiality and system integrity.
Recommendation
It is recommended to immediately update insights-client to a version that does not log request headers, and to rotate pull-secret tokens. Also, restrict access to pod logs to trusted users only.
Original NVD description (English source)
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.