CVE-2026-71475

Modified Modified - Updated After Analysis

insights-client API URL Path Injection via ClusterID

Publication date: 2026-08-11

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-27

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-71475

EUVD

EUVD-2026-56899

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	advanced_cluster_management_for_kubernetes	2.0
redhat	insights-client	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-71475 is a flaw in the insights-client package where a compromised managed cluster (spoke) can inject unencoded ClusterID values directly into the Insights API URL path on the hub cluster. The ClusterID is controlled by the spoke and used without validation or URL encoding, allowing path traversal or request redirection.

Detection Guidance

To detect this vulnerability, inspect the ClusterID values in ManagedCluster.Status.ClusterClaims on the hub cluster. Check if the ClusterID contains path traversal sequences or unexpected characters. Review logs for insights-client requests to the API endpoint for unusual paths or redirections.

Impact Analysis

A malicious spoke could redirect authenticated requests to unintended API endpoints, potentially leading to unauthorized access, information disclosure, or data manipulation on the hub cluster. This could expose sensitive data or allow attackers to manipulate system behavior.

Compliance Impact

This vulnerability could lead to unauthorized access or data leakage, which may violate compliance requirements for data protection such as GDPR or HIPAA. Unauthorized exposure of sensitive data could result in regulatory penalties or legal consequences.

Mitigation Strategies

Isolate compromised spoke clusters immediately. Monitor network traffic for unauthorized API requests. Apply network policies to restrict outbound connections from spoke clusters. Follow updates from Red Hat Product Security for official patches or mitigations.

Hi! I’m here to help you understand CVE-2026-71475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70