CVE-2026-70496
Full vulnerability record from the local CVENow database.
Description
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
Severity
CRITICAL
CVSS score
9.9
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-19 19:17:23.230000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-70496",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T19:17:23.230",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster."
},
{
"lang": "es",
"value": "Se encontró un fallo en search-v2-operator. El ClusterRole del operador tiene permisos equivalentes a los de un administrador de clúster, lo que le permite suplantar a otras entidades, escribir configuraciones de control de acceso basado en roles (RBAC), aprobar solicitudes de firma de certificados (CSRs) y gestionar ManifestWork. Esto otorga privilegios excesivos más allá de lo necesario para la función prevista del operador, lo que podría conducir a una escalada de privilegios dentro del clúster."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.11::el9"
],
"versions": [
{
"version": "1787688827",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"versions": [
{
"version": "1787682112",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"versions": [
{
"version": "1787682033",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"versions": [
{
"version": "1787681674",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"versions": [
{
"version": "1787681686",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
],
"versions": [
{
"version": "1787681651",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/search-collector-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
],
"versions": [
{
"version": "1787229539",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhacm2/multiclusterhub-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-25T03:37:08.803389Z",
"id": "CVE-2026-70496",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-250"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:60386",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60387",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60388",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60389",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60390",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60391",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-70496",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511032",
"source": "[email protected]"
}
]
}