This vulnerability arises because the ClusterID, controlled by a compromised spoke cluster, is used directly in the Insights API request path without proper validation or URL encoding. This improper limitation of a pathname to a restricted directory (CWE-22) allows the malicious spoke to perform path traversal or redirect authenticated requests to unintended API endpoints on the hub cluster. The flaw affects Red Hat Advanced Cluster Management for Kubernetes 2.13 and is tracked as CVE-2026-71475 with a CVSS 3.1 base score of 6.8 (medium severity). The attack vector is network-based with low complexity but requires high privileges on the spoke. The scope is changed, and the impact is high confidentiality loss without integrity or availability impact. Red Hat's advisory confirms the vulnerability and states that no suitable mitigation or patch currently meets their criteria for deployment.

A compromised managed cluster (spoke) can exploit this vulnerability to redirect authenticated requests on the hub cluster to unintended API endpoints. This can lead to unauthorized access or information disclosure on the hub cluster. The vulnerability does not affect data integrity or availability. The attack requires high privileges on the spoke cluster and no user interaction. The confidentiality impact is high, while integrity and availability impacts are none.

According to the Red Hat advisory, no mitigation or patch currently meets the criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's official advisories for updates. Until a fix is available, limiting the exposure of managed clusters and restricting privileges on spoke clusters may reduce risk, but no official mitigation is provided.