CVE-2026-71475: Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.
Other sources
ClusterID is read from ManagedCluster.Status.ClusterClaims["id.openshift.io"] (fallback id.k8s.io). ClusterClaims are set by the registration/work agent on the managed (spoke) cluster and synced verbatim into the hub ManagedCluster.status -- they are spoke-controlled data crossing a trust boundary. The value is concatenated raw into the request path: http.NewRequest("GET", endpoint+"/cluster/"+cluster.ClusterID+"/reports", nil), with the hub's pull-secret bearer token attached. No UUID validation or URL encoding is applied. A compromised spoke can inject path traversal sequences or redirect the authenticated request to unintended API endpoints.
Upstream: stolostron/insights-client
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71475?
The severity of CVE-2026-71475 is rated as medium with a score of 5.
How do I fix CVE-2026-71475?
To fix CVE-2026-71475, ensure that input data is properly validated and URL encoded before being included in the Insights API URL path.
What software is affected by CVE-2026-71475?
CVE-2026-71475 affects the insights-client software.
What kind of vulnerability is CVE-2026-71475?
CVE-2026-71475 is categorized as a Path Traversal vulnerability.
What happens if CVE-2026-71475 is exploited?
Exploitation of CVE-2026-71475 allows a compromised managed cluster to inject unencoded data into the Insights API URL path.