A critical (CVSS 9.9) excessive-privilege flaw in the search-v2-operator component of Red Hat Advanced Cluster Management for Kubernetes 2 grants the operator cluster-administrator-equivalent permissions, opening a path to privilege escalation across the cluster.
What Is It
Red Hat's security team disclosed a flaw in search-v2-operator where the operator's ClusterRole carries permissions equivalent to a cluster administrator. Per the advisory, those permissions allow the operator to impersonate other entities, write RBAC configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork resources. This is far beyond what the operator's intended function requires, and it can lead to privilege escalation within the cluster.
The issue is classified as CWE-250 (Execution with Unnecessary Privileges). The CVSS 3.1 base score of 9.9 CRITICAL, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, is the CNA-assigned score carried in the CVE record; the NVD entry linked below is the authoritative place to check whether NVD has since published its own analysis or a differing severity.
Why It Matters
The CVSS vector tells the story: network attack vector, low attack complexity, only low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. An attacker who obtains even limited access in a context that can leverage the operator's ClusterRole inherits capabilities, impersonation, RBAC writes, CSR approval, that are effectively the keys to the cluster. RBAC write access and CSR approval in particular are classic escalation primitives: they let an attacker mint new identities and grant themselves further permissions.
As of 2026-08-19, CVE-2026-70496 does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation at this time. The catalog is published as a searchable list and machine-readable JSON/CSV feed (linked below); readers can confirm the current status directly against it.
What's Vulnerable
Red Hat lists the following packages under Red Hat Advanced Cluster Management for Kubernetes 2 (cpe:/a:redhat:acm:2):
Affected:
- rhacm2/acm-search-v2-rhel9
- rhacm2/search-collector-rhel9
Not affected:
- rhacm2/multiclusterhub-rhel9
Patch Status
The NVD record was published 2026-08-19 with a vulnerability status of Received, meaning NVD had not yet completed its own analysis at that point. As of that date, neither the NVD entry nor the Red Hat CVE page and Bugzilla entry linked below states a fixed version or a specific required action. Those three pages are the places to check for current remediation guidance and any updated severity assessment; Red Hat typically posts fixed container image tags and errata advisories on the CVE page once remediation ships.
Sources
- Red Hat Security; CVE-2026-70496: https://access.redhat.com/security/cve/CVE-2026-70496
- Red Hat Bugzilla #2511032: https://bugzilla.redhat.com/show_bug.cgi?id=2511032
- NVD, CVE-2026-70496: https://nvd.nist.gov/vuln/detail/CVE-2026-70496
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog