PatchTheCVECVE-2026-71845: A flaw was found in insights-client
38
Routine
MEDIUM 6.3WATCHLISTDOWNGRADEMITIGATE
CVE-2026-71845 is a medium-severity flaw (CVSS 6.3) affecting advanced cluster management for kubernetes, insights-client. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CC
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 58%) |
| CISA exploited list | No |
| Weakness | CWE-532 |
| Published | 2026-08-11 |
| Last modified | 2026-10-23 |
Publisher (CNA): Red Hat, Inc. · Vendor: redhat
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
redhat advanced cluster management for kubernetes DOWNGRADE
Affected: 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy advanced-cluster-management-for-kubernetes || rpm -q advanced-cluster-management-for-kubernetes || advanced-cluster-management-for-kubernetes --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison advanced-cluster-management-for-kubernetes
sudo apt install advanced-cluster-management-for-kubernetes=<VERSION_BEFORE_2.0>
sudo apt-mark hold advanced-cluster-management-for-kubernetes
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list advanced-cluster-management-for-kubernetes
sudo dnf downgrade advanced-cluster-management-for-kubernetes-<VERSION_BEFORE_2.0>
sudo dnf versionlock add advanced-cluster-management-for-kubernetes
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat insights-client MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy insights-client || rpm -q insights-client || insights-client --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · clementine · FIXED · 1.4.2-1.fc46 · FEDORA-2026-3e748ef4d3 · source
sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-71475 MEDIUM 6.8 DOWNGRADE MITIGATE A flaw was found in insights-client
- CVE-2026-71474 HIGH 7.1 DOWNGRADE MITIGATE A flaw was found in insights-client
- CVE-2026-71846 MEDIUM 6.5 DOWNGRADE MITIGATE A flaw was found in insights-client