PatchTheCEVCVE-2026-71846: A flaw was found in insights-client
29
Routine
MEDIUM 6.5WATCHLISTDOWNGRADEMITIGATE
CVE-2026-71846 is a medium-severity flaw (CVSS 6.5) affecting advanced cluster management for kubernetes, insights-client. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sens
Why this priority
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 95%) |
| CISA exploited list | No |
| Weakness | CWE-250 |
| Published | 2026-08-12 |
| Last modified | 2026-10-23 |
Publisher (CNA): Red Hat, Inc. · Vendor: redhat
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
redhat advanced cluster management for kubernetes DOWNGRADE
Affected: 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy advanced-cluster-management-for-kubernetes || rpm -q advanced-cluster-management-for-kubernetes || advanced-cluster-management-for-kubernetes --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison advanced-cluster-management-for-kubernetes
sudo apt install advanced-cluster-management-for-kubernetes=<VERSION_BEFORE_2.0>
sudo apt-mark hold advanced-cluster-management-for-kubernetes
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list advanced-cluster-management-for-kubernetes
sudo dnf downgrade advanced-cluster-management-for-kubernetes-<VERSION_BEFORE_2.0>
sudo dnf versionlock add advanced-cluster-management-for-kubernetes
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat insights-client MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy insights-client || rpm -q insights-client || insights-client --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-71475 MEDIUM 6.8 DOWNGRADE MITIGATE A flaw was found in insights-client
- CVE-2026-71845 MEDIUM 6.3 DOWNGRADE MITIGATE A flaw was found in insights-client
- CVE-2026-71474 HIGH 7.1 DOWNGRADE MITIGATE A flaw was found in insights-client