Read the docs
TI-2026-50090 Aliases CVE-2026-71475GHSA-gqvx-3g3q-49g9

Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00694 53rd percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—1787259125Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—1786882244Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—1787238585Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—1787184541Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17—1787227689Patch availableCNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 VendorRed Hat Affected — Fixed in 1787259125 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 VendorRed Hat Affected — Fixed in 1786882244 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 VendorRed Hat Affected — Fixed in 1787238585 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 VendorRed Hat Affected — Fixed in 1787184541 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1787227689 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 5 advisories

  • RHSA-2026:60391 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
Show 2 more Red Hat advisories
  • RHSA-2026:60389 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:60389
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:60391
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Not affected: 5 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71475
  2. 2026-10-03 Alias added: GHSA-gqvx-3g3q-49g9

References

Advisory 7

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-10313 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… CVSS 3.1HIGH 7.5
  • TI-2026-04135 Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.1 CVSS 3.1HIGH 8.2
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences