The setDefault() function in pkg/config/config.go logs every environment variable it consumes via glog.V(2).Infof("Using %s from environment: %s", env, val), including CCX_TOKEN — a bearer credential used by disconnected clusters as an alternative to cloud.redhat.com (which is unreachable from their environments). At -v>=2 verbosity, the token is printed in clear text to the pod log on every startup. The credential is then accessible to any principal with pods/log access in the open-cluster-management namespace or access to centralized logging (Loki/Elasticsearch), crossing a privilege boundary since log readers typically do not have secrets access to the credential source.

Code path: main.go:36 SetupConfig() → pkg/config/config.go:46 setDefault(&Cfg.CCXToken, "CCX_TOKEN", "") → config.go:62 glog.V(2).Infof("Using %s from environment: %s", env, val).

Preconditions: (1) Operator has set -v>=2 on the insights-client Deployment (non-default but routinely enabled for debugging); (2) CCX_TOKEN environment variable is configured (disconnected cluster deployments).

Upstream: stolostron/insights-client