A critical (CVSS 9.1) input-validation flaw in the acm-search-v2-rhel9 container of Red Hat Advanced Cluster Management for Kubernetes 2 lets an authenticated user inject shell commands or SQL through the Search Custom Resource's WORK_MEM value.
What Is It
The Search CR accepts a WORK_MEM string that is passed into both a bash script and an SQL query without proper validation. An authenticated attacker, such as a hub administrator or anyone with edit rights on the Search CR, can supply crafted input that breaks out of its intended context and executes as shell commands or SQL statements. Red Hat classifies the weakness as CWE-78 (OS Command Injection). Successful exploitation yields arbitrary code execution inside the privileged postgres pod, which can lead to broader system compromise.
Why It Matters
The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base score 9.1, CRITICAL (NVD). Two elements drive that rating. First, Scope: Changed: code runs in a privileged pod, so impact escapes the vulnerable component's own security boundary. Second, full High impact across confidentiality, integrity, and availability. The mitigating factor is PR:H, this is not an unauthenticated internet-facing bug; it requires an already-privileged position on the hub cluster. Practically, it is a privilege-escalation and lateral-movement primitive: a Search CR editor who should be constrained to configuration turns that access into code execution in a privileged workload.
None of the sources cited below report active exploitation of CVE-2026-71472.
What's Vulnerable
- Vendor: Red Hat
- Product: Red Hat Advanced Cluster Management for Kubernetes 2
- Package:
rhacm2/acm-search-v2-rhel9 - CPE:
cpe:/a:redhat:acm:2 - Default status: affected
The NVD record does not enumerate specific fixed or unaffected version ranges.
Patch Status
The CVE was published 2026-08-17 with a vulnerability status of Received, meaning NVD analysis is still pending (NVD). The supplied record lists no fix version, no mitigation guidance, and no required-action deadline. Administrators should track the Red Hat CVE page and Bugzilla entry below for updated errata and remediation instructions.
Sources
- NVD, CVE-2026-71472, https://nvd.nist.gov/vuln/detail/CVE-2026-71472
- Red Hat Security Advisory, CVE-2026-71472, https://access.redhat.com/security/cve/CVE-2026-71472
- Red Hat Bugzilla #2512151; https://bugzilla.redhat.com/show_bug.cgi?id=2512151
- Red Hat Package Browser; https://access.redhat.com/downloads/content/package-browser/