A critical (CVSS 9.1) flaw in the search-v2-operator lets a Custom Resource editor in Red Hat Advanced Cluster Management for Kubernetes 2 swap container images and inject secrets, escalating to full cluster compromise.
What Is It
A flaw was found in the search-v2-operator that allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one.
Red Hat classifies the issue as CWE-913 (Improper Control of Dynamically-Managed Code Resources) and assigns a CVSS 3.1 base score of 9.1 CRITICAL, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Why It Matters
The impact is not contained to the search workload. The vulnerability leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions; which is why the CVSS scope is marked CHANGED and confidentiality, integrity, and availability impacts are all HIGH.
Attack complexity is LOW, the attack vector is NETWORK, and no user interaction is required. The mitigating factor is that high privileges are required: the attacker must already hold CR edit rights on the Search CR. How much that constrains an attacker depends entirely on local RBAC design. In multi-tenant or delegated-administration clusters, CR edit rights may be delegated to operators who are not cluster admins; where that is the case, the boundary between "namespace-scoped editor" and "cluster owner" would effectively collapse. Administrators should verify against their own RBAC bindings rather than assume the separation holds.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; no KEV entry was supplied, so there is no confirmed active exploitation or federally mandated remediation deadline at this time.
What's Vulnerable
- Vendor: Red Hat
- Product: Red Hat Advanced Cluster Management for Kubernetes 2 (
cpe:/a:redhat:acm:2) - Package:
rhacm2/acm-search-v2-rhel9 - Default status: affected
Patch Status
The available data contains no fixed version, patch reference, or vendor-specified required action for this CVE. Administrators should treat the record as still in flux and check the Red Hat security advisory and Bugzilla entry below directly for current analysis state and remediation guidance, and in the interim review who holds edit permissions on Search CRs.
Sources
- Red Hat Security; CVE-2026-71470: https://access.redhat.com/security/cve/CVE-2026-71470
- Red Hat Bugzilla; Bug 2512149: https://bugzilla.redhat.com/show_bug.cgi?id=2512149
- Red Hat Package Browser: https://access.redhat.com/downloads/content/package-browser/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog