The jsonPost function in json-request.ts uses a module-level https.Agent({ rejectUnauthorized: false }) for all calls where no HttpsProxyAgent is supplied. The upgrade-risks-prediction.ts module reads the cluster pull-secret (openshift-config/pull-secret) with the SA token, extracts auths['cloud.openshift.com'].auth, and POSTs it as a Bearer token to https://console.redhat.com/api/insights-results-aggregator/v2/upgrade-risks-prediction. When HTTPS_PROXY is unset, this outbound internet request runs with server certificate validation disabled.

A network-positioned attacker (MITM) can intercept the pull-secret credential in transit between the hub and console.redhat.com. The pull-secret is a high-value credential that grants access to Red Hat container registries and cloud services.

Affected files: backend/src/lib/json-request.ts (lines 11, 42), backend/src/routes/upgrade-risks-prediction.ts

Fix branch: glasswing/f003
Engineering contact: Kevin Cormier
Jira: ACM-38693

Discovered by: Project Glasswing AI-SAST campaign (HP Mythos)