EUVD-2026-56898
GHSA-h2jx-ffv3-pwqm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Log access requires low privilege (PR:L) over network (AV:N); stolen credential affects CCX API beyond the pod (S:C); no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.
AnalysisAI
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit conditions must both be satisfied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals place this at moderate-to-elevated risk within its target population despite the High CVSS score of 7.7. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71845 for the patched version of insights-client - no specific fixed package version was confirmed from the available input data, so treat the advisory as authoritative on patch availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Red Hat insights-client deployments in disconnected clusters to identify instances with glog verbosity set to level 2 or higher. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The grc-policy-propagator allows security escalation within the cluster. Rated high severity (CVSS 7.8), this vulnerabil
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server
Credential exposure in Red Hat insights-client leaks the cloud.openshift.com pull-secret token into pod logs whenever th
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct
A security vulnerability in Red Hat Advanced Cluster Management (CVSS 5.5) that allows an unprivileged user. Remediation
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences int
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Rated low severity (CVSS 3.5), this vulnerability is l
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today