Bug 2512154 (CVE-2026-71475) - CVE-2026-71475 insights-client-rhel9: CVE-2026-71475 insights-client: Spoke-controlled ClusterID injected unencoded into Insights API URL path
Summary: CVE-2026-71475 insights-client-rhel9: CVE-2026-71475 insights-client: Spoke-c...
Keywords:
Status: NEW
Alias: CVE-2026-71475
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-06 19:36 UTC by OSIDB Bzimport
Modified: 2026-08-11 18:19 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-06 19:36:20 UTC 
ClusterID is read from ManagedCluster.Status.ClusterClaims["id.openshift.io"] (fallback id.k8s.io). ClusterClaims are set by the registration/work agent on the managed (spoke) cluster and synced verbatim into the hub ManagedCluster.status -- they are spoke-controlled data crossing a trust boundary. The value is concatenated raw into the request path: http.NewRequest("GET", endpoint+"/cluster/"+cluster.ClusterID+"/reports", nil), with the hub's pull-secret bearer token attached. No UUID validation or URL encoding is applied. A compromised spoke can inject path traversal sequences or redirect the authenticated request to unintended API endpoints.

Upstream: stolostron/insights-client
Note You need to log in before you can comment on or make changes to this bug.