A flaw in the insights-client's setDefault() function causes it to log the value of every environment variable it processes, including the sensitive CCX_TOKEN bearer credential. When the glog verbosity level is set to 2 or higher, this token is written in clear text to pod logs on every startup. This exposure allows an attacker with access to pod logs or centralized logging systems to retrieve the token and use it to access the CCX API, potentially compromising disconnected cluster deployments that rely on this credential.

The vulnerability leads to the exposure of a sensitive bearer token (CCX_TOKEN) in clear text within pod logs. This token grants access to the CCX API used by disconnected cluster deployments. Unauthorized access to this token could allow an attacker to impersonate the affected organization when interacting with the CCX API. There is no impact on integrity or availability, but confidentiality is highly impacted.

Currently, no official patch or fix is confirmed. The vendor advisory recommends setting the glog verbosity level on the insights-client deployment below level 2 (e.g., -v=0 or -v=1) to prevent logging the token. Additionally, if CCX_TOKEN must be used in disconnected environments, access to pod logs in the open-cluster-management namespace and to centralized logging backends should be strictly restricted. Monitor the Red Hat advisory for updates on official fixes.