CVE-2026-71845

Modified Modified - Updated After Analysis

Insights-Client Logs Sensitive CCX_TOKEN Credential in Plaintext

Publication date: 2026-08-11

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description

A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-27

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-71845

EUVD

EUVD-2026-56898

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	advanced_cluster_management_for_kubernetes	2.0
redhat	insights-client	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

CVE-2026-71845 is a flaw in the insights-client component where the setDefault() function logs environment variables, including the CCX_TOKEN bearer credential, in clear text when glog verbosity is set to level 2 or higher. This token is used for disconnected cluster deployments and could be exposed in pod logs.

Detection Guidance

Check pod logs in the open-cluster-management namespace for clear text CCX_TOKEN entries. Use commands like 'oc logs <pod-name> -n open-cluster-management' or 'kubectl logs <pod-name> -n open-cluster-management'. Also review centralized logging systems like Loki or Elasticsearch for logs containing CCX_TOKEN.

Impact Analysis

An attacker with access to pod logs or centralized logging could obtain the CCX_TOKEN and use it to gain unauthorized access to the CCX API, potentially compromising the affected organization's systems or data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA, which mandate protection of personal and health information.

Mitigation Strategies

Set glog verbosity below level 2 by using '-v=0' or '-v=1' in insights-client startup arguments. Restrict access to pod logs in the open-cluster-management namespace and centralized logging backends if CCX_TOKEN is configured.

Hi! I’m here to help you understand CVE-2026-71845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70