What’s Vulnerable › Vulnerabilities

CVE-2026-71475: Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-22

Description

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2: 2.0
• RedHat Insights-Client: all versions

References

• https://access.redhat.com/errata/RHSA-2026:60386
• https://access.redhat.com/errata/RHSA-2026:60388
• https://access.redhat.com/errata/RHSA-2026:60389
• https://access.redhat.com/errata/RHSA-2026:60390
• https://access.redhat.com/errata/RHSA-2026:60391
• https://access.redhat.com/security/cve/CVE-2026-71475
• https://bugzilla.redhat.com/show_bug.cgi?id=2512154

Get alerted when CVE-2026-71475 or the next vulnerability affects your stack