CVE-2026-71474 is a vulnerability in the insights-client component of Red Hat Advanced Cluster Management for Kubernetes 2.11. When the client receives a non-200 HTTP response, it logs request headers that may include the cloud.openshift.com pull-secret token. This token is a long-lived credential that, if exposed in pod logs accessible to local users, could allow unauthorized access to Red Hat cloud services. The exposure requires specific logging conditions (verbosity level 3 or higher) and existing permissions to access pod logs. Red Hat has not provided an official patch or mitigation that meets their criteria for ease of use, applicability, and stability.

The vulnerability allows local users with access to pod logs on the hub to read sensitive pull-secret tokens, which are long-lived credentials for Red Hat cloud services. This could lead to unauthorized access to these cloud services. The impact is confidentiality loss only; integrity and availability are not affected. Exploitation requires local access and specific logging configurations.

Red Hat currently does not offer a mitigation or patch that meets their product security criteria for this issue. Users should be aware that the exposure depends on logging at verbosity level 3 or higher and existing pod log access permissions. Limiting log verbosity and restricting pod log access to trusted users may reduce exposure risk until an official fix is available. Monitor Red Hat's advisory for updates.