Description

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-11T20:18:45.547Z",
  "pubdate": "2026-08-11T20:18:45.547Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in the insights-client application, leading to the potential exposure of sensitive authentication credentials.\nThe vulnerability manifests when the application processes a non-200 HTTP response from remote services, causing it to log complete request headers.\nThese logged headers inadvertently capture the cloud.openshift.com pull-secret token, which functions as a long-lived credential granting access to Red Hat cloud services.\nThe primary impact of this flaw is the unauthorized exposure of high-privilege cloud tokens to any local user possessing read access to pod logs on the hub.\nExploitation requires a local attacker to have authorization or capabilities to inspect container or pod logs where the insights-client execution output is recorded.\nRisk implications include unauthorized access to proprietary Red Hat cloud services, potential lateral movement within cloud environments, and prolonged exposure due to the long-lived nature of the leaked pull-secret token.\nNo specific version numbers are provided in the input, but the flaw specifically impacts the insights-client component under specific error-handling conditions.",
  "technicalDetails": "The root cause of this vulnerability lies in insecure error-handling and logging practices within the insights-client codebase.\nWhen the application issues an outbound HTTP request and receives a non-200 status code response, the logging subsystem captures and records the entire outbound request header set for diagnostic purposes.\nBecause the outbound request headers include authorization credentials—specifically the cloud.openshift.com pull-secret token—these sensitive tokens are written directly to the application's standard output or log files in plaintext.\nThe vulnerable component is the HTTP response handling and logging mechanism within insights-client.\nThe attack flow proceeds as follows: First, the insights-client initiates an API request that subsequently results in a non-200 HTTP error response from the upstream server. Second, the internal error-handling routine captures the request context and serializes the request headers into the logging stream. Third, the long-lived cloud.openshift.com pull-secret token is persisted within the pod's logging infrastructure. Fourth, a local user or adversary with local access to pod logs on the hub queries or inspects the log storage. Finally, the adversary extracts the plaintext pull-secret token from the logs.\nAuthentication requirements for exploitation are minimal regarding the log retrieval phase; the attacker must be a local user possessing permissions to read pod logs on the hub.\nPrivilege requirements are restricted to local log access capabilities within the orchestrator or hub environment, rather than requiring administrative privileges on the underlying node.\nNetwork exposure is not strictly required for the exploitation phase itself, as the vulnerability is exploited locally via log inspection, though the initial trigger relies on upstream HTTP communication returning a non-200 status code.\nThe post-exploitation impact involves the unauthorized utilization of the extracted cloud.openshift.com pull-secret token, allowing the attacker to impersonate legitimate services or users, access restricted Red Hat cloud services, and potentially access supplementary downstream resources tied to the compromised token."
}