CVE-2026-71845 is a moderate severity vulnerability in the insights-client component of Red Hat Advanced Cluster Management for Kubernetes. The setDefault() function logs every environment variable it processes, including the sensitive CCX_TOKEN bearer credential. When glog verbosity is configured at level 2 or higher, this token is written in clear text to pod logs on every startup. An attacker with access to these logs or centralized logging systems could extract the token and use it to access the CCX API without authorization. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File).

Exposure of the CCX_TOKEN bearer credential in pod logs can lead to unauthorized access to the CCX API for disconnected cluster deployments. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires an attacker to have access to pod logs or centralized logging systems, and the attack complexity is high due to this prerequisite. The CVSS 3.1 base score is 6.3 (medium severity).

Red Hat advises setting the glog verbosity level for the insights-client deployment below level 2 (e.g., -v=0 or -v=1) to prevent logging the CCX_TOKEN in clear text. If the CCX_TOKEN must be used in disconnected environments, access to pod logs in the open-cluster-management namespace and to centralized logging backends should be strictly restricted. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for updates.