CVE-2026-71474High· 7.1▾ TwilightA flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
advanced_cluster_management_for_kubernetes = 2.0insights-clientRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71845Medium· 6.3A flaw was found in insights-client
CVE-2026-71846Medium· 6.5A flaw was found in insights-client
CVE-2026-71475Medium· 6.8A flaw was found in insights-client
CVE-2026-75485Medium· 5.5A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes
CVE-2026-4740High· 8.2A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM)
CVE-2025-3910Medium· 5.4A flaw was found in Keycloak