REDHAT-BUG-2512568: Medium severity stolostron/insights-client vulnerability
The setDefault() function in pkg/config/config.go logs every environment variable it consumes via glog.V(2).Infof("Using %s from environment: %s", env, val), including CCXTOKEN — a bearer credential used by disconnected clusters as an alternative to cloud.redhat.com (which is unreachable from their environments). At -v>=2 verbosity, the token is printed in clear text to the pod log on every startup. The credential is then accessible to any principal with pods/log access in the open-cluster-management namespace or access to centralized logging (Loki/Elasticsearch), crossing a privilege boundary since log readers typically do not have secrets access to the credential source.
Code path: main.go:36 SetupConfig() → pkg/config/config.go:46 setDefault(&Cfg.CCXToken, "CCXTOKEN", "") → config.go:62 glog.V(2).Infof("Using %s from environment: %s", env, val).
Preconditions: (1) Operator has set -v>=2 on the insights-client Deployment (non-default but routinely enabled for debugging); (2) CCXTOKEN environment variable is configured (disconnected cluster deployments).
Upstream: stolostron/insights-client
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512568?
The severity of REDHAT-BUG-2512568 is categorized as medium with a score of 4.
What are the implications of REDHAT-BUG-2512568?
REDHAT-BUG-2512568 has implications for credential exposure, as it logs sensitive environment variables like CCX_TOKEN.
How can REDHAT-BUG-2512568 be mitigated?
To mitigate REDHAT-BUG-2512568, avoid using the setDefault() function to handle sensitive environment variables in logs.
What software is affected by REDHAT-BUG-2512568?
The software affected by REDHAT-BUG-2512568 is stolostron/insights-client.
When was REDHAT-BUG-2512568 published?
REDHAT-BUG-2512568 was published on August 7, 2026.