CVE-2026-71474

This CVE reveals a design failure: the insights-client tool logs request headers—including authentication tokens—on error paths, exposing production credentials to anyone with access to pod logs. The vulnerability isn't the logging itself; it's that credential-bearing headers were ever included in that logging. This is a code hygiene problem with systemic consequences, not because the development team lacks security awareness, but because the standard debugging practice of dumping headers on errors was never audited for sensitive content before shipping. The severity is deceptively low in CVSS (6.3). The pull-secret token used for Red Hat hub-spoke authentication is long-lived by design—rotation is operationally expensive, so organizations treat it as persistent. That persistence transforms an incidental log leak into permanent unauthorized access. The token isn't just a credential to one system; in hub-spoke architectures, it authenticates to the hub, which may then grant access to all attached spokes. One leaked token, one CVE, but multiplied access vectors across the entire infrastructure topology. The access scope of 'local user with pod logs' is broader than it appears. Platform operators, SREs with debugging access, and cross-project principals in multi-tenant environments all have log access by default. The token has likely already propagated beyond the original pod logs—into node journald, central SIEM aggregation, object storage, and possibly cold archives with retention periods measured in years. Rotation closes future exposure but doesn't purge existing logs. There's no standard remediation for 'credential extrusion' that verifies all downstream log consumers have been audited. Prioritize token rotation immediately, independent of the patch timeline. The exposure window compounds daily—the longer the vulnerable code ran before detection, the more log streams contain the token, each with independent retention schedules. Treat the CVSS as a technical severity rating, not a risk assessment; the temporal and architectural dimensions make this more severe than the score suggests. Audit your log aggregation pipeline and SIEM for any systems that may have captured and retained these logs before assuming remediation is complete.

Reviewed through automated stages and approved by a human before publication.