Insights Client
Monthly
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Credential exposure in Red Hat insights-client leaks the cloud.openshift.com pull-secret token into pod logs whenever the application receives a non-200 HTTP response from Red Hat cloud services. Any local user holding pod-log read permissions on the OpenShift hub cluster can silently extract this long-lived bearer token and use it to access Red Hat cloud services without authorization. No public exploit or active exploitation has been confirmed at time of analysis, but the Changed Scope in the CVSS vector reflects that a successful credential harvest extends the attacker's reach well beyond the initial cluster boundary.
A vulnerability was found in insights-client. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Token credential exposure in Red Hat insights-client causes the CCX_TOKEN bearer credential, used exclusively in disconnected cluster deployments, to be written in clear text to pod logs on every startup when glog verbosity is set to level 2 or higher. Any party with read access to pod logs or an aggregated logging backend can silently harvest this credential and use it to authenticate against the CCX API, extending access beyond the originating pod (CVSS scope change S:C). No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) combined with SSVC exploitation status of 'none' indicates this remains theoretical rather than actively targeted.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Credential exposure in Red Hat insights-client leaks the cloud.openshift.com pull-secret token into pod logs whenever the application receives a non-200 HTTP response from Red Hat cloud services. Any local user holding pod-log read permissions on the OpenShift hub cluster can silently extract this long-lived bearer token and use it to access Red Hat cloud services without authorization. No public exploit or active exploitation has been confirmed at time of analysis, but the Changed Scope in the CVSS vector reflects that a successful credential harvest extends the attacker's reach well beyond the initial cluster boundary.
A vulnerability was found in insights-client. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.