A critical (CVSS 9.0) flaw in the acm-search-v2-rhel9 component of Red Hat Advanced Cluster Management for Kubernetes 2 lets a hub-cluster admin with patch access to the Search CR push an arbitrary container image to every managed cluster, resulting in remote code execution across the fleet.
What Is It
Red Hat disclosed a vulnerability in acm-search-v2-rhel9 affecting the Collector.ImageOverride field of the Search Custom Resource. An attacker holding administrative privileges on the hub cluster, specifically, patch access to the Search CR, can set that field to an arbitrary container image. The image is then deployed across all managed clusters, giving the attacker remote code execution and the ability to run commands and potentially access sensitive information fleet-wide.
The issue is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L, base score 9.0, CRITICAL. Confidentiality and integrity impact are HIGH, availability LOW, and the scope is CHANGED, reflecting that compromise of the hub propagates outward into the managed clusters it governs.
Why It Matters
Privileges required are HIGH, so this is not a pre-auth internet-facing bug. What raises it to critical is scope: a single hub-cluster admin account, or any credential, token, or service account that can patch the Search CR, converts into code execution on the entire managed fleet in one step. That turns a contained hub-side compromise into a fleet-wide breach and makes ACM's centralized management plane a high-value pivot. Attack vector is NETWORK with LOW complexity and no user interaction.
What's Vulnerable
- Vendor: Red Hat
- Product: Red Hat Advanced Cluster Management for Kubernetes 2 (
cpe:/a:redhat:acm:2) - Package:
rhacm2/acm-search-v2-rhel9 - Default status: affected
Patch Status
The CVE was published 2026-08-12 with NVD status "Received," and no fixed version is listed in the supplied data. There is no CISA KEV entry for this CVE, so active exploitation is not confirmed and no KEV remediation deadline applies. Consult the Red Hat security advisory below for current fix availability, and in the interim tightly restrict patch permissions on the Search CR.
Sources
- NVD, CVE-2026-71471: https://nvd.nist.gov/vuln/detail/CVE-2026-71471
- Red Hat Security; CVE-2026-71471: https://access.redhat.com/security/cve/CVE-2026-71471
- Red Hat Bugzilla #2512150: https://bugzilla.redhat.com/show_bug.cgi?id=2512150