CVE-2026-71474

HighCVSS 7.1/10Last modified Oct 24, 2026

Description

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.11	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—

References

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-714756.8A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights AP CVE-2026-714768.7Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote CVE-2026-714776.7mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and g CVE-2026-714786.1league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and CVE-2026-714799.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controll CVE-2026-71486.3A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation o CVE-2026-714838.5Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in CVE-2026-714859.1Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRe CVE-2026-714864.3vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/de CVE-2026-714887.5league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines c CVE-2026-71497.3A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the functi CVE-2026-714907.1OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned c