CVE-2026-71474EPSS p4.2%

CVE-2026-71474CVE-2026-71474

redhat / advanced_cluster_management_for_kubernetes

Description

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

Scoring

CVSS 7.1 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS0.16% probability of exploitation · percentile 4.2% · 2026-10-05T12:00:23Z
Last modified2026-09-05
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.