Read the docs
TI-2026-50174 Aliases CVE-2026-71845GHSA-h2jx-ffv3-pwqm

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

Priority LOW 34CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-532.

Summary

A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11—1787688993Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—1787259125Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—1786882244Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—1787238585Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—1787184541Patch availableCNA
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17—1787227689Patch availableCNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1787688993 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 VendorRed Hat Affected — Fixed in 1787259125 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 VendorRed Hat Affected — Fixed in 1786882244 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 VendorRed Hat Affected — Fixed in 1787238585 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 VendorRed Hat Affected — Fixed in 1787184541 Patch available CNA
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1787227689 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 6 advisories

  • RHSA-2026:60391 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
Show 3 more Red Hat advisories
  • RHSA-2026:60389 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:60389
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:60391
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Not affected: 6 products
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71845
  2. 2026-10-03 Alias added: GHSA-h2jx-ffv3-pwqm

References

Advisory 8

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2026-23208 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVSS 4.0HIGH 8.7
  • TI-2022-10313 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go… CVSS 3.1HIGH 7.5
  • TI-2026-04135 Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.1 CVSS 3.1HIGH 8.2
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences