---
id: CVE-2026-71845
title: A flaw was found in insights-client
summary: >-
  A flaw was found in insights-client. The setDefault() function logs the value
  of every environment variable it processes, including CCX_TOKEN, a bearer
  credential used in disconnected cluster deployments. When glog verbosity is
  set to le…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-532
vendor: redhat
product: advanced_cluster_management_for_kubernetes
affected:
  - advanced_cluster_management_for_kubernetes = 2.0
  - insights-client
published: '2026-08-11'
updated: '2026-09-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71845'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:60386'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60387'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60388'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60389'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60390'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:60391'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71845'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512568'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71845.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71845'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71845'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00284
epssPercentile: 0.21213
ingestedAt: '2026-09-05T16:41:56.440Z'
patched:
  - advanced_cluster_management_for_kubernetes 2.11
  - advanced_cluster_management_for_kubernetes 2.13
  - advanced_cluster_management_for_kubernetes 2.14
  - advanced_cluster_management_for_kubernetes 2.15
  - advanced_cluster_management_for_kubernetes 2.16
  - advanced_cluster_management_for_kubernetes 2.17
---

## Overview

A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.

## Affected

- `advanced_cluster_management_for_kubernetes = 2.0`
- `insights-client`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)
- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)
- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)
- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)
- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)
- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)