A flaw was discovered in the insights-client component of Red Hat Advanced Cluster Management for Kubernetes 2, where a compromised managed cluster, called a "spoke," can inject unencoded data into the Insights API URL path. This unsanitized cluster ID, controlled by the spoke, is used directly in request URLs, enabling a path traversal style attack. The result is that authenticated requests can be redirected to unintended API endpoints, potentially exposing sensitive data or allowing unauthorized access. The weakness is a classic path traversal vulnerability, reflected in the CWE-22 identifier. The vulnerability carries a CVSS score of 5, indicating moderate severity.

The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2, specifically its insights-client component. No vendor-specified affected versions are listed beyond the overall product, and no exact version range is provided.

Based on the description, it is inferred that an attacker must first compromise a spoke to control the cluster ID. The exploit requires this internal foothold and can redirect authenticated API traffic to malicious endpoints. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the presence of path traversal with potential for data disclosure warrants a moderate risk due to the possible impact on confidentiality for users of the platform. The likely attack vector is internal to the cluster, targeting the clusterID field used by insights-client.