Red Hat Insights-Client vulnerabilities

5 CVEs affecting Red Hat Insights-Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71846, published 2026-08-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-71475, published 2026-08-11. Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is…
CVE-2026-71845, published 2026-08-11. High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster…
CVE-2023-3972, published 2023-11-01. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege…
CVE-2026-71846, published 2026-08-12. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a…
CVE-2026-71474, published 2026-08-11. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with…