A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with acce…
Medium CVSS 6.3
Summary
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://access.redhat.com/security/cve/CVE-2026-71474 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2512153 Issue Tracking
Timeline
- nvd_ingest NVD