漏洞概述 漏洞编号: CVE-2026-71474 漏洞标题: insights-client-rhel9: CVE-2026-71474 insights-client: Pull-secret bearer token written to logs on non-200 CCK response 状态: NEW 报告日期: 2026-08-06 19:36 UTC by OSOB Bzreport 修改日期: 2026-08-11 18:18 UTC (history) 组件: vulnerability 优先级: medium 严重程度: medium 目标里程碑: --- 分配给: Product Security QA 联系人: --- 文档联系人: --- URL: --- 白板: --- 依赖项: --- 阻塞项: --- 树视图: depends on / blocked 影响范围 硬件: All 操作系统: Linux 版本: unspecified 环境: --- 最后关闭: --- 已固定版本: --- 克隆自: --- CC 列表: 3 users (show) 修复方案 上游: stolostron/insights-client 详细描述 描述: CreateInsightsRequest sets the Authorization header to "Bearer " + the cloud.openshift.com pull-secret token. In CallInsights, when the response status is not 200, the function logs the request headers at verbosity > 3 via slog.V(3).Infof("Response header for request %v, req.Header), which writes the cluster's long-lived cloud.openshift.com pull-secret credential to stderr / pod logs. Pod logs on the hub are readable by any principal with pod/log access. The pull-secret is a long-lived credential that grants access to Red Hat cloud services. POC代码或利用代码 代码块: 其他信息 附件: --- 条款使用: --- 备注: You need to log in before you can comment on or make changes to this bug.