CVE-2026-71845: Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.
Other sources
The setDefault() function in pkg/config/config.go logs every environment variable it consumes via glog.V(2).Infof("Using %s from environment: %s", env, val), including CCXTOKEN — a bearer credential used by disconnected clusters as an alternative to cloud.redhat.com (which is unreachable from their environments). At -v>=2 verbosity, the token is printed in clear text to the pod log on every startup. The credential is then accessible to any principal with pods/log access in the open-cluster-management namespace or access to centralized logging (Loki/Elasticsearch), crossing a privilege boundary since log readers typically do not have secrets access to the credential source.
Code path: main.go:36 SetupConfig() → pkg/config/config.go:46 setDefault(&Cfg.CCXToken, "CCXTOKEN", "") → config.go:62 glog.V(2).Infof("Using %s from environment: %s", env, val).
Preconditions: (1) Operator has set -v>=2 on the insights-client Deployment (non-default but routinely enabled for debugging); (2) CCXTOKEN environment variable is configured (disconnected cluster deployments).
Upstream: stolostron/insights-client
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the insights-client Deployment does not run with -v>=2; set glog verbosity to level 0 or 1 so CCX_TOKEN is not printed in clear text to pod logs on startup.
insights-client glog verbosity (flag -v) = < 2 - Configuration
Modify/disable the setDefault() behavior that logs consumed environment variables via glog.V(2).Infof("Using %s from environment: %s", env, val) so bearer credentials like CCX_TOKEN are not written to logs even when verbose logging is used.
insights-client Logging of environment variables (glog.V(2).Infof in setDefault) = disabled - Operational
After changing logging verbosity/behavior, rotate the CCX API bearer credential (CCX_TOKEN) because it may have been exposed in pod logs/centralized logging when -v>=2 was enabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71845?
CVE-2026-71845 has a medium severity rating of 6.3.
How do I fix CVE-2026-71845?
To fix CVE-2026-71845, ensure that glog verbosity is set below level 2 to prevent logging sensitive tokens in clear text.
What type of vulnerability is CVE-2026-71845?
CVE-2026-71845 is a vulnerability that exposes a bearer credential (CCX_TOKEN) in clear text through logging.
Which software is affected by CVE-2026-71845?
CVE-2026-71845 affects the insights-client software.
What could be the impact of CVE-2026-71845?
The impact of CVE-2026-71845 includes potential exposure of sensitive credentials due to logging at high verbosity levels.