CVE-2026-71468
Full vulnerability record from the local CVENow database.
Description
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.
Severity
MEDIUM
CVSS score
5.3
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-11 20:18:45.410000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-71468",
"sourceIdentifier": "[email protected]",
"published": "2026-08-11T20:18:45.410",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en acm-search-v2-API-rhel9. Cuyo la función ’getFederationConfig’ actualiza su caché, reutiliza de forma indebida el token de portador de un usuario para todas las solicitudes federadas subsiguientes hasta que la caché caduque. Esto permite a otros usuarios autenticados obtener acceso no autorizado a los resultados de búsqueda de hubs gestionados remotos, lo que lleva a la revelación de información."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-api-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.11::el9"
],
"versions": [
{
"version": "1787689524",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-api-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"versions": [
{
"version": "1787263804",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-api-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"versions": [
{
"version": "1786723845",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-api-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"versions": [
{
"version": "1787238618",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-api-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"versions": [
{
"version": "1787191668",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-api-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
],
"versions": [
{
"version": "1787229541",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-12T16:04:10.874102Z",
"id": "CVE-2026-71468",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-266"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:60386",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60387",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60388",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60389",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60390",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60391",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-71468",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512147",
"source": "[email protected]"
}
]
}