CVE-2026-71474: Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Other sources
CreateInsightsRequest sets the Authorization header to "Bearer " + the cloud.openshift.com pull-secret token. In CallInsights, when the response status is not 200, the function logs the request headers at verbosity >= 3 via glog.V(3).Infof("Response header for report %v", req.Header), which writes the cluster's long-lived cloud.openshift.com pull-secret credential to stderr / pod logs. Pod logs on the hub are readable by any principal with pods/log access. The pull-secret is a long-lived credential that grants access to Red Hat cloud services.
Upstream: stolostron/insights-client
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71474?
The severity of CVE-2026-71474 is medium with a score of 6.3.
What is the risk associated with CVE-2026-71474?
The risk associated with CVE-2026-71474 is rated at 37.
How do I fix CVE-2026-71474?
To fix CVE-2026-71474, update the insights-client to the latest version where this vulnerability is addressed.
What does CVE-2026-71474 disclose?
CVE-2026-71474 discloses that a pull-secret bearer token can be logged in request headers on non-200 responses.
Who is affected by CVE-2026-71474?
Any local user with access to pod logs on the hub could be affected by CVE-2026-71474.