What is the CVSS score of EUVD-2026-56899?

EUVD-2026-56899 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

insights-client EUVD-2026-56899

| CVE-2026-71475 MEDIUM

Path Traversal (CWE-22)

2026-08-11 secalert@redhat.com

GHSA-gqvx-3g3q-49g9

Authentication Bypass Information Disclosure Path Traversal Red Hat Advanced Cluster Management For Kubernetes Insights Client

6.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

5.0 MEDIUM

PR:L reflects the required spoke cluster authentication relationship; S:C captures hub API impact beyond the vulnerable client; C:L only, as traversal enables information disclosure without integrity or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 02, 2026 - 16:22 NVD

5.0 (MEDIUM) 6.8 (MEDIUM)

Analysis Generated

Aug 11, 2026 - 23:28 vuln.today

DescriptionCVE.org

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

AnalysisAI

Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

insights-client is the Red Hat Insights data collection and reporting agent used in RHEL and OpenShift managed environments. The vulnerability arises from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) - the client constructs API request URLs by directly embedding the ClusterID, a value sourced from the spoke cluster, without URL encoding or validation. In a hub-and-spoke architecture (e.g., OpenShift with ACM), each spoke reports its identity via ClusterID. If an adversary controls the spoke, they can craft a ClusterID containing traversal sequences (e.g., '../') or other path components, causing the hub to issue API requests to unintended endpoints. The CVSS Scope:Changed metric confirms the impact extends beyond the vulnerable insights-client component itself to the Insights API infrastructure.

RemediationAI

The primary remediation is to apply the vendor-supplied patch from Red Hat once available; check https://access.redhat.com/security/cve/CVE-2026-71475 and https://bugzilla.redhat.com/show_bug.cgi?id=2512154 for the latest advisory and patched package version, as no specific fixed version was identified in the available intelligence. As a compensating control prior to patching, operators should enforce strict validation and allowlisting of ClusterID values at the hub's API gateway or ingress layer, rejecting any ClusterID containing path separator characters, dot sequences, or percent-encoded variants - note this may require custom WAF rules and could reject legitimately unusual cluster identifiers. Additionally, restricting which API endpoints are reachable from spoke-initiated requests through network policy or RBAC can limit the blast radius of a successful traversal attempt, though this requires careful policy tuning to avoid breaking legitimate Insights telemetry flows.