CVE-2026-71474: insights-client Information Disclosure

CVE-2026-71474 Overview

A flaw exists in insights-client that exposes sensitive authentication material through application logs. When the client receives a non-200 HTTP response, it writes the full request headers, including the cloud.openshift.com pull-secret token, into pod logs. A local user with read access to those pod logs on the hub can retrieve this long-lived credential. The disclosed token can then be used to gain unauthorized access to Red Hat cloud services.

The issue is classified as an information exposure through log files weakness [CWE-532] and affects Red Hat OpenShift environments running the vulnerable insights-client.

Critical Impact
Disclosure of long-lived cloud.openshift.com pull-secret tokens to any local user able to read hub pod logs, enabling unauthorized access to Red Hat cloud services.

Affected Products

Red Hat insights-client
Red Hat OpenShift environments consuming cloud.openshift.com pull secrets
Hub clusters where insights-client pod logs are accessible to local users

Discovery Timeline

2026-08-11 - CVE-2026-71474 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-71474

Vulnerability Analysis

The vulnerability resides in the error-handling path of insights-client. On any non-200 response from the upstream service, the client emits diagnostic output containing the full HTTP request headers. Because the Authorization header carries the cloud.openshift.com pull-secret token, that token is written verbatim into pod logs.

Pull-secret tokens are long-lived credentials used to authenticate to Red Hat cloud services. Once written to logs, the token is durable and portable. Anyone who can retrieve the log stream, including via oc logs or through a log aggregation pipeline, obtains a working credential without triggering an authentication event.

The attack requires network reachability to trigger the non-200 response path and local access on the hub to read the resulting logs, which is reflected in the elevated attack complexity and the scope change to other Red Hat services.

Root Cause

The root cause is unsanitized logging of HTTP request headers on error paths [CWE-532]. Sensitive header values, specifically the bearer token used against cloud.openshift.com, are not redacted before being written to the diagnostic log sink.

Attack Vector

An adversary induces or waits for a non-200 response from the upstream Insights endpoint. The insights-client running on the hub logs the outbound request headers, including the pull-secret token. A local user with permission to read the client's pod logs extracts the token and reuses it against Red Hat cloud services outside the cluster's authentication boundary.

No verified exploit code has been published for CVE-2026-71474. See the Red Hat CVE-2026-71474 Advisory and Red Hat Bugzilla Report #2512153 for technical details.

Detection Methods for CVE-2026-71474

Indicators of Compromise

Presence of Authorization, Bearer, or pull-secret token strings within insights-client pod logs.
Log entries from insights-client containing HTTP header dumps following non-200 response codes.
Unexpected API calls to cloud.openshift.com originating from IP addresses outside the cluster's normal egress ranges.

Detection Strategies

Scan archived and live insights-client pod logs for regex patterns matching bearer tokens and pull-secret formats.
Correlate oc logs and Kubernetes audit events targeting insights-client pods with subsequent authentication activity against Red Hat cloud services.
Alert on any non-200 response events logged by insights-client that immediately precede header dumps.

Monitoring Recommendations

Enable Kubernetes audit logging for get and list operations on pod logs in namespaces hosting insights-client.
Forward insights-client logs to a centralized store and apply detection rules for credential patterns rather than relying on local retention.
Monitor Red Hat cloud service access patterns for tokens used from unexpected geographies or clients.

How to Mitigate CVE-2026-71474

Immediate Actions Required

Restrict RBAC permissions so only trusted service accounts can read insights-client pod logs on hub clusters.
Rotate the cloud.openshift.com pull-secret token if insights-client logs may have been exposed to untrusted local users.
Purge historical insights-client logs that contain header dumps from log aggregation systems.

Patch Information

Refer to the Red Hat CVE-2026-71474 Advisory for the current patch status and fixed package versions. Apply the vendor-supplied insights-client update on all hub clusters once available.

Workarounds

Reduce insights-client log verbosity to suppress header dumps until a patched version is installed.
Apply Kubernetes RBAC policies that deny pods/log access on the insights-client namespace for non-administrative accounts.
Redirect insights-client output through a log filter that strips Authorization and pull-secret headers before persistence.

bash

# Example RBAC restriction limiting pod log access on the insights-client namespace
kubectl create role restrict-logs \
  --verb=get,list \
  --resource=pods/log \
  --namespace=openshift-insights

kubectl create rolebinding restrict-logs-binding \
  --role=restrict-logs \
  --serviceaccount=openshift-insights:insights-admin \
  --namespace=openshift-insights