# CVE-2026-71474: A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers…

Source: https://junglewise.ai/threats/cve-2026-71474-a-flaw-was-found-in-insights-client-when-the-application-receives  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11  
License: CC BY 4.0 with a link back

CVE-2026-71474 · Severity: high · CVSS 7.1 · Published 2026-08-11

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

Technologies: [Redhat Advanced Cluster Management For Kubernetes](https://junglewise.ai/threats/technologies/advanced-cluster-management-for-kubernetes), [Redhat Insights-Client](https://junglewise.ai/threats/technologies/insights-client). Vendors: [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-71474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71474 being exploited in the wild.

**How severe is CVE-2026-71474?** High severity, with a CVSS score of 7.1, published 11 August 2026.

**Which products and versions are affected?** Redhat Advanced Cluster Management For Kubernetes, Redhat Insights-Client. The advisory does not name versions.

**Is there a fix for CVE-2026-71474?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-71474?** Check whether you run Redhat Advanced Cluster Management For Kubernetes or Redhat Insights-Client. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Redhat Advanced Cluster Management For Kubernetes
- Redhat Insights-Client

## Related threats

- [Red Hat insights-client excessive Kubernetes permissions in ServiceAccount](https://junglewise.ai/threats/cve-2026-71846-red-hat-insights-client-excessive-kubernetes-permissions-in)
- [A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it…](https://junglewise.ai/threats/cve-2026-71845-a-flaw-was-found-in-insights-client-the-setdefault-function-logs)
- [A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded…](https://junglewise.ai/threats/cve-2026-71475-a-flaw-was-found-in-insights-client-a-compromised-managed-cluster)
- [Red Hat Multicluster Engine for Kubernetes privilege escalation in /etc/passwd](https://junglewise.ai/threats/cve-2025-57851-red-hat-multicluster-engine-for-kubernetes-privilege-escalation)
- [Open Cluster Management privilege escalation in certificate renewal validation](https://junglewise.ai/threats/cve-2026-4740-open-cluster-management-privilege-escalation-in-certificate)