REDHAT-BUG-2512153: Medium severity stolostron/insights-client vulnerability
CreateInsightsRequest sets the Authorization header to "Bearer " + the cloud.openshift.com pull-secret token. In CallInsights, when the response status is not 200, the function logs the request headers at verbosity >= 3 via glog.V(3).Infof("Response header for report %v", req.Header), which writes the cluster's long-lived cloud.openshift.com pull-secret credential to stderr / pod logs. Pod logs on the hub are readable by any principal with pods/log access. The pull-secret is a long-lived credential that grants access to Red Hat cloud services.
Upstream: stolostron/insights-client
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512153?
The severity of REDHAT-BUG-2512153 is classified as medium with a severity score of 4.
How do I fix REDHAT-BUG-2512153?
To mitigate REDHAT-BUG-2512153, ensure to implement appropriate access controls and restrict logging sensitive information.
What impact does REDHAT-BUG-2512153 have on security?
REDHAT-BUG-2512153 can potentially expose sensitive token information through verbose logging, which poses a security risk.
Which software is affected by REDHAT-BUG-2512153?
The affected software for REDHAT-BUG-2512153 is stolostron/insights-client.
When was REDHAT-BUG-2512153 published?
REDHAT-BUG-2512153 was published on August 6, 2026.