CVE-2026-71475: Insights-Client Path Traversal Flaw

CVE-2026-71475 Overview

CVE-2026-71475 is a path traversal vulnerability [CWE-22] in the insights-client component. A compromised managed cluster, referred to as a spoke, can inject unencoded data into the Insights API URL path. The root cause is that the ClusterID, which is controlled by the spoke, is inserted directly into the request path without validation or URL encoding. A malicious spoke can redirect authenticated requests to unintended API endpoints. Successful exploitation can lead to information disclosure or unauthorized access to hub-side API resources.

Critical Impact
A compromised spoke cluster can manipulate hub-issued authenticated API requests, exposing data from unintended Insights API endpoints.

Affected Products

Red Hat insights-client
Managed cluster deployments where a hub processes spoke-provided ClusterID values
Downstream Red Hat products embedding the affected client (see Red Hat advisory for the authoritative list)

Discovery Timeline

2026-08-11 - CVE-2026-71475 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71475

Vulnerability Analysis

The flaw resides in how insights-client constructs outbound requests to the Insights API. The ClusterID value originates from a managed spoke cluster and is concatenated into the URL path without sanitization or percent-encoding. Because the spoke controls this value, it can supply characters such as ../, /, or ? that alter the intended request path.

The resulting request is still signed with the hub's credentials. This lets a compromised spoke pivot authenticated calls toward endpoints it should not reach. The impact is limited to confidentiality, since the vulnerability does not directly modify data or affect availability. The scope change reflects that a spoke-controlled input crosses a trust boundary and affects hub-issued requests.

Root Cause

The root cause is missing input validation and missing URL encoding on the ClusterID field before it is placed in the Insights API request path. The client trusts a value that originates outside the hub's trust boundary. This is a classic path-injection pattern tracked as CWE-22.

Attack Vector

An attacker must first compromise or operate a managed spoke cluster registered to a hub running insights-client. The attacker sets a crafted ClusterID containing traversal or delimiter characters. When the hub next issues an authenticated Insights API call referencing that spoke, the malformed path routes the request to an attacker-chosen endpoint. The response, received by the hub, may disclose data the spoke would not otherwise be authorized to access. No user interaction is required, and the attack proceeds over the network.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-71475 Advisory and Red Hat Bug #2512154 for authoritative technical detail.

Detection Methods for CVE-2026-71475

Indicators of Compromise

Outbound Insights API requests containing encoded or literal traversal sequences such as %2f..%2f, ../, or unexpected ? and # characters in the path segment normally occupied by a cluster identifier.
Insights API access logs showing requests to endpoints that do not correspond to any legitimate ClusterID registered on the hub.
Spoke registrations whose ClusterID deviates from the expected UUID format.

Detection Strategies

Validate that every ClusterID submitted by a spoke matches a strict UUID regular expression before it is logged, stored, or forwarded.
Inspect proxy or egress logs on the hub for Insights API request paths containing characters outside the allowed cluster identifier character set.
Correlate spoke onboarding events with the first outbound Insights request referencing that spoke, and alert on anomalous path structures.

Monitoring Recommendations

Enable verbose HTTP client logging on insights-client and forward events to a centralized log platform for path-anomaly analysis.
Track 3xx redirects and 4xx responses from the Insights API, since crafted paths often generate distinctive error patterns.
Baseline the set of Insights API endpoints normally invoked by the hub and alert on newly observed endpoints.

How to Mitigate CVE-2026-71475

Immediate Actions Required

Apply the fixed insights-client package as soon as Red Hat publishes it for your channel. Consult the Red Hat CVE-2026-71475 Advisory for package versions.
Audit all currently registered spoke clusters and remove or quarantine any spoke whose ClusterID does not conform to the expected UUID format.
Rotate hub credentials used for Insights API authentication if suspicious path activity is found in historical logs.

Patch Information

Red Hat is tracking the fix under Red Hat Bug #2512154. The corrective change adds URL encoding and input validation for the ClusterID before it is inserted into the Insights API request path. Consult the vendor advisory for the exact fixed package versions applicable to your subscription.

Workarounds

Enforce strict UUID validation on ClusterID values at spoke registration time, rejecting any value containing /, ., ?, #, or percent-encoded equivalents.
Deploy an egress proxy between the hub and the Insights API that normalizes request paths and blocks traversal sequences.
Restrict which spokes can register to the hub using network segmentation and mutual TLS until the patched client is deployed.

bash

# Example egress policy: block Insights API paths containing traversal characters
# (adjust for your proxy technology)
location /r/insights/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2f\.\.)") {
        return 400;
    }
    proxy_pass https://cert.console.redhat.com;
}