Threats tagged 'ghsa-gqvx-3g3q-49g9'

A vulnerability in insights-client allows a compromised managed cluster ('spoke') to inject unencoded data into the Insights API URL path. This occurs because the ClusterID, controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This flaw can enable a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially causing information disclosure or unauthorized access. The issue is tracked as CVE-2026-71475 with a medium severity rating and a CVSS score of 5. A security update addressing this vulnerability is available in Red Hat Advanced Cluster Management for Kubernetes version 2.17.1.