The insights-client application logs request headers, including the cloud.openshift.com pull-secret token, when it receives a non-200 response and logging verbosity is set to 3 or higher. This token is written to stderr and pod logs on the hub, making it accessible to any local user who has permission to read pod logs. This information disclosure vulnerability (CWE-532) could allow unauthorized access to Red Hat cloud services. The vulnerability has a CVSS 3.1 base score of 6.3 (medium severity) with network attack vector, high attack complexity, low privileges required, no user interaction, and a confidentiality impact only. Red Hat has not released an official fix or mitigation that meets their criteria for broad deployment.

Exposure of the cloud.openshift.com pull-secret token in pod logs can lead to unauthorized access to Red Hat cloud services by local users with pod log access. The impact is limited by the need for specific logging conditions (verbosity level 3 or higher) and existing permissions to access pod logs. There is no impact on integrity or availability.

Currently, no official fix or mitigation is available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should be aware of the risk when enabling high verbosity logging levels and restrict pod log access to trusted users only. Monitor Red Hat advisories for future updates or patches.