CVE-2026-71845: insights-client Credential Disclosure Bug

CVE-2026-71845 Overview

CVE-2026-71845 is a medium-severity information disclosure vulnerability in insights-client. The setDefault() function logs the value of every environment variable it processes during startup. This includes CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. The flaw is classified under CWE-532: Insertion of Sensitive Information into Log File.

Critical Impact
An attacker with read access to pod logs or a centralized logging backend can retrieve the CCX_TOKEN bearer credential and gain unauthorized access to the CCX API.

Affected Products

Red Hat insights-client component used in disconnected cluster deployments
Deployments running glog at verbosity level 2 or higher
Environments processing the CCX_TOKEN environment variable

Discovery Timeline

2026-08-11 - CVE-2026-71845 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-71845

Vulnerability Analysis

The vulnerability resides in the setDefault() function of insights-client. During initialization, the function iterates over the process environment and emits each variable name and value through glog. The logging call is unconditional and applies no filter for credential-bearing variables such as tokens, keys, or passwords.

When operators run the client with glog verbosity at level 2 or higher, the CCX_TOKEN bearer credential is written to the pod's stdout in clear text on every startup. Kubernetes and OpenShift capture stdout to pod logs, which are typically forwarded to centralized logging platforms such as Loki, Elasticsearch, or Splunk. Any principal with get/list on the pods/log subresource, or with query access to the aggregation backend, can retrieve the credential.

The attack requires network reachability but no user interaction. Exploitation depends on the attacker already possessing low-privilege access to logs, which is why the attack complexity is rated high. Successful retrieval yields unauthorized access to the CCX API under the identity bound to the token.

Root Cause

The root cause is unfiltered environment variable logging. setDefault() treats every environment variable as non-sensitive diagnostic data. The function lacks an allowlist or denylist that would mask values for known credential variables such as CCX_TOKEN.

Attack Vector

An attacker with access to pod logs, log aggregation pipelines, or persistent log storage searches for the CCX_TOKEN string. Once retrieved, the token is replayed as a bearer credential against the CCX API endpoint. No exploitation code is required beyond standard log queries and HTTP client tooling.

See the Red Hat CVE-2026-71845 Advisory and the Red Hat Bug 2512568 Report for vendor technical details.

Detection Methods for CVE-2026-71845

Indicators of Compromise

Presence of the literal string CCX_TOKEN= followed by a token value in pod stdout or aggregated logs.
insights-client pods started with glog verbosity flags -v=2 or higher, or --v 2.
CCX API access log entries showing token use from unexpected source IPs or user agents.

Detection Strategies

Grep or query centralized logs for CCX_TOKEN substring matches across all insights-client pod streams and historical indices.
Audit pod specs and Helm/Operator values for glog verbosity settings of 2 or higher on insights-client workloads.
Correlate CCX API authentication events with insights-client startup times to detect out-of-band token replay.

Monitoring Recommendations

Alert on any log line containing CCX_TOKEN= at ingestion time and quarantine the affected index.
Track changes to insights-client deployment manifests that raise glog verbosity above the default.
Monitor CCX API for authentication from source addresses outside the expected cluster egress range.

How to Mitigate CVE-2026-71845

Immediate Actions Required

Lower glog verbosity on all insights-client deployments to level 1 or below to stop new disclosures.
Rotate any CCX_TOKEN values that may have appeared in pod logs or aggregation backends.
Purge historical log entries containing CCX_TOKEN from centralized logging storage and backups.
Restrict RBAC on the pods/log subresource and on log aggregation platforms to least privilege.

Patch Information

Refer to the Red Hat CVE-2026-71845 Advisory for fixed package versions and errata. The upstream fix is expected to mask sensitive environment variable values in setDefault() before they reach glog.

Workarounds

Run insights-client with glog verbosity at the default level until the patched build is deployed.
Deliver CCX_TOKEN via a mounted secret file rather than an environment variable where the client supports it.
Apply log-scrubbing filters in Fluent Bit, Vector, or the logging operator to redact CCX_TOKEN values before forwarding.

bash

# Example Fluent Bit filter to redact CCX_TOKEN values before forwarding
[FILTER]
    Name    modify
    Match   kube.*insights-client*
    Condition Key_value_matches log CCX_TOKEN=

[FILTER]
    Name    lua
    Match   kube.*insights-client*
    call    redact
    code    function redact(tag, ts, record) record["log"] = string.gsub(record["log"], "CCX_TOKEN=[^%s]+", "CCX_TOKEN=REDACTED") return 2, ts, record end