Vulnerability Details CVE-2026-71474
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 5.2%
CVSS Severity
CVSS v3 Score 6.3
References
Products affected by CVE-2026-71474
-
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0
-
cpe:2.3:a:redhat:insights-client:-