What is the CVSS score of CVE-2026-71474?

CVE-2026-71474 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of insights-client are affected by CVE-2026-71474?

Red Hat insights-client running on Advanced Cluster Management hub clusters exposes long-lived pull-secret tokens to pod logs accessible to local cluster users.

How to fix or mitigate CVE-2026-71474?

Within 24 hours, audit ACM hub cluster pod logs for exposed pull-secret tokens and monitor Red Hat cloud service authentication logs for suspicious access patterns or unauthorized logins. Within 7 days, apply vendor-released errata patches to insights-client across all ACM hub clusters and verify logs no longer contain credential data. Within 30 days, implement least-privilege access controls restricting pod log visibility to authorized operations teams only and conduct a complete review of pull-secret usage for signs of compromise.

insights-client CVE-2026-71474

EUVD-2026-56902 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-08-11 secalert@redhat.com

GHSA-6q5x-r3rm-rpv8

Information Disclosure Red Hat Advanced Cluster Management For Kubernetes Insights Client

7.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Pod log read access requires Kubernetes RBAC grant (PR:L); scope change retained because the leaked credential enables access to external Red Hat cloud services.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

6.3 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 02, 2026 - 16:40 vuln.today

tag: Authentication Bypass removed

Analysis Updated

Sep 02, 2026 - 16:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 02, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Sep 02, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Sep 02, 2026 - 16:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

CVSS changed

Aug 24, 2026 - 16:52 NVD

6.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 11, 2026 - 23:29 vuln.today

DescriptionCVE.org

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

AnalysisAI

Sensitive credential leakage in Red Hat insights-client exposes cloud.openshift.com pull-secret tokens through application log files on Advanced Cluster Management hub clusters. When insights-client receives any non-200 HTTP response from the Red Hat cloud endpoint, it writes the full request headers - including the long-lived pull-secret bearer token - to pod logs readable by local cluster users. An attacker who harvests this token can authenticate against Red Hat cloud services without possessing their own credentials. No public exploit has been identified at time of analysis, and multiple vendor-released errata patch the behavior.

Technical ContextAI

insights-client is the Red Hat Insights telemetry and remediation agent, integrated into Advanced Cluster Management for Kubernetes (ACM) to relay managed-cluster data to cloud.openshift.com. The root cause is CWE-532 (Insertion of Sensitive Information into Log File): the client's error-logging routine captures the full HTTP request context - including the Authorization header carrying the OpenShift pull-secret token - whenever the remote endpoint returns a non-200 status code. This pull-secret is a long-lived credential used to authenticate against Red Hat's registry and cloud APIs. Affected CPEs are cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:* and cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*. The CVSS scope change (S:C) reflects that the leaked token grants reach into Red Hat cloud infrastructure well beyond the local cluster.

RemediationAI

Apply the applicable Red Hat errata from the RHSA-2026:6038x series (RHSA-2026:60386 through RHSA-2026:60391), available at https://access.redhat.com/errata/RHSA-2026:60386 and the parallel entries; these correct the header-logging behavior in insights-client so pull-secret tokens are not written to log output. Specific patched binary versions are not enumerated in available input data and should be confirmed against the errata pages directly. If immediate patching is blocked, restrict Kubernetes RBAC so that only cluster-admin roles can execute 'kubectl logs' on the insights-client pod namespace - this limits who can harvest already-written tokens but does not prevent new ones from being written. Independently of patching, rotate the cloud.openshift.com pull-secret token used by the affected hub, as any token written to historical logs should be considered compromised; rotation instructions are available in the OpenShift pull-secret management documentation. Finally, audit existing pod logs for Authorization header values to determine whether the token was already exposed prior to patching.