CVE-2023-3972

CVE-2023-3972 affects the insights-client in TencentOS Server (2 and 3). The issue arises from insecure file operations/handling of temporary files, allowing an unprivileged local user to create the /var/tmp/insights-client directory before root registers the insights-client. After registration b...

CVE-2026-71475

The CVE describes a vulnerability in insights-client for RHEL9 where a compromised spoke can inject an unencoded ClusterID into the Insights API URL path. Since the ClusterID is used directly in the request path without validation or URL encoding, authenticated requests can be redirected to unint...

CVE-2026-71846

CVE-2026-71846 – Insights-client : A flaw in insights-client exposes cluster-wide Secrets by binding the component’s ServiceAccount to a ClusterRole with get/list/watch on all Secrets, while the code only requires access to a single Secret. This privilege escalation means that if the insights-cli...

CVE-2026-71474

CVE-2026-71474 affects insights-client (noted in the CVE record as insights-client-rhel9). The flaw: when insights-client receives a non-200 HTTP response, it logs request headers, which may include the cloud.openshift.com pull-secret token. A local user with access to hub pod logs could read thi...

CVE-2026-71845

A flaw in insights-client causes the setDefault() function to log the value of every environment variable it processes, including CCX_TOKEN , a bearer credential used in disconnected cluster deployments . When glog verbosity is set to level 2 or higher, the token is written in clear text to the p...