The vulnerability occurs in the insights-client’s setDefault() function, which logs all environment variables it processes. When the CCX_TOKEN environment variable, a bearer credential used in disconnected cluster deployments, is set, the token is written in clear text to the pod log on every startup if glog verbosity is configured at level 2 or higher. This results in credential disclosure that an attacker can exploit to gain unauthorized access to the CCX API. The weakness is classified as CWE‑532, indicating improper handling of sensitive data in logs.

Red Hat Advanced Cluster Management for Kubernetes 2 is affected. The vulnerability applies to deployments of this version; no other product versions were listed.

The CVSS score of 6.3 places the vulnerability in the medium severity range, and the EPSS score of < 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. An attacker would need access to pod logs or to a centralized logging back‑end for the open‑cluster‑management namespace to capture the exposed token; with such access, they could authenticate to the CCX API with the stolen bearer credential. The presence of a simple workaround reduces risk if applied, but the default high log verbosity keeps the token exposed until remedied.