CVE-2026-71475

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60391
https://access.redhat.com/security/cve/CVE-2026-71475	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2512154	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:::::::*
	cpe:2.3:a:redhat:insights-client:-:::::::*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en insights-client. Un clúster gestionado comprometido, conocido como un ’spoke’, puede inyectar datos sin codificar en la ruta URL de la API de Insights. Esto ocurre porque el ClusterID, que es controlado por el spoke, se utiliza directamente en la ruta de la solicitud sin una validación adecuada o codificación URL. Esta vulnerabilidad permite a un spoke malicioso redirigir solicitudes autenticadas a puntos finales de API no deseados, lo que podría llevar a una revelación de información o acceso no autorizado.

Information

Published : 2026-08-11 20:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71475

Mitre link : CVE-2026-71475

CVE.ORG link : CVE-2026-71475

JSON object : View

Products Affected

redhat

insights-client
advanced_cluster_management_for_kubernetes

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-71475", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71475", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:40:11.167392Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787259125", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-client-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1786882244", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-client-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787238585", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-client-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787184541", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-client-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787227689", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/insights-client-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-11T20:18:45.673", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-71475", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512154", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en insights-client. Un cl\u00faster gestionado comprometido, conocido como un \u2019spoke\u2019, puede inyectar datos sin codificar en la ruta URL de la API de Insights. Esto ocurre porque el ClusterID, que es controlado por el spoke, se utiliza directamente en la ruta de la solicitud sin una validaci\u00f3n adecuada o codificaci\u00f3n URL. Esta vulnerabilidad permite a un spoke malicioso redirigir solicitudes autenticadas a puntos finales de API no deseados, lo que podr\u00eda llevar a una revelaci\u00f3n de informaci\u00f3n o acceso no autorizado."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B0E6B4B-BAA6-474E-A18C-72C9719CEC1F"}, {"criteria": "cpe:2.3:a:redhat:insights-client:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79FB6214-FF6C-49E3-9F87-BD9E2B0A18C7"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}