EUVD-2026-56899
GHSA-gqvx-3g3q-49g9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:L reflects the required spoke cluster authentication relationship; S:C captures hub API impact beyond the vulnerable client; C:L only, as traversal enables information disclosure without integrity or availability consequences.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.
AnalysisAI
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already controls a spoke (managed cluster) in the targeted multi-cluster Red Hat Insights deployment - specifically, the ability to manipulate the ClusterID value that the spoke reports to the hub. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 5.0 (Medium) is grounded in a network-reachable, low-complexity attack with low privileges and changed scope, but confidentiality impact is limited (C:L) with no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-supplied patch from Red Hat once available; check https://access.redhat.com/security/cve/CVE-2026-71475 and https://bugzilla.redhat.com/show_bug.cgi?id=2512154 for the latest advisory and patched package version, as no specific fixed version was identified in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The grc-policy-propagator allows security escalation within the cluster. Rated high severity (CVSS 7.8), this vulnerabil
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconn
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server
Sensitive credential leakage in Red Hat insights-client exposes cloud.openshift.com pull-secret tokens through applicati
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct
A security vulnerability in Red Hat Advanced Cluster Management (CVSS 5.5) that allows an unprivileged user. Remediation
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Rated low severity (CVSS 3.5), this vulnerability is l
Same weakness CWE-22 – Path Traversal
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today