CVE-2026-71475

Name of the Vulnerable Software and Affected Versions insights-client (affected versions not specified)

Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is controlled by the spoke, is used in the request path without proper validation or URL encoding. This allows a malicious spoke to redirect authenticated requests to unintended API endpoints, which could result in unauthorized access or information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.