CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

Important: Red Hat Security Advisory: Insights proxy Container Image

Initial GA Release of Red Hat Insights proxy The Insights proxy Container is used by the Insights proxy product RPM and serves as an intermediary between cystomer systems in disconnected networks, air-gapped systems or systems with no outside connections and Insights. The Insights proxy routes al...

CVE-2026-19391

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...

CVE-2026-19391

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...

EUVD-2026-55951

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...

CVE-2026-19391

The CVE affects the insights-core password redaction layer, which does not recognize credentials beyond the literal string 'password'. This allows sensitive credentials such as SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in ar...

CVE-2026-19391

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...

PT-2026-70870

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is...

Linux Distros Unpatched Vulnerability : CVE-2026-19391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows...

PT-2026-70869

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where the application logs request headers upon receiving a non-200 response. This process may expose the cloud.openshift.com pull-secret token. A local user with access...

PT-2026-70871

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists in the setDefault function that logs the value of every environment variable it processes. This includes CCX TOKEN, a bearer credential used in disconnected cluster...

PT-2026-70074

Name of the Vulnerable Software and Affected Versions insights-core affected versions not specified Description A flaw in the password redaction layer fails to recognize credentials that are not keyed under the literal string 'password'. This issue allows SSSD LDAP bind passwords, specifically th...

EUVD-2026-54318

Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...

EUVD-2026-54300

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2026-49163

Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...

CVE-2026-49163 Application Insights Profiler Elevation of Privilege Vulnerability

...

CVE-2026-49163

Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...

CVE-2026-49163 Application Insights Profiler Elevation of Privilege Vulnerability

...

CVE-2026-49163

CVE-2026-49163 concerns an improper limitation of a pathname to a restricted directory (path traversal) in Application Insights Profiler, enabling an authorized attacker to elevate privileges over the network. The entry specifies a CVSSv3.1 base score of 8.8 (High) with Network attack vector, Low...