CVE-2026-71473
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Severity
HIGH
CVSS score
8.5
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-12 22:17:16.020000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-71473",
"sourceIdentifier": "[email protected]",
"published": "2026-08-12T22:17:16.020",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity."
},
{
"lang": "es",
"value": "Se encontró una falla en el componente “search-v2-operator”. Un usuario con permisos administrativos específicos en un clúster gestionado puede explotar una vulnerabilidad que le permite inyectar datos de configuración arbitrarios. Esta manipulación puede sobrescribir configuraciones críticas, lo que lleva al reemplazo de imágenes de contenedor. Esto en última instancia resulta en la inyección de imágenes de contenedor en el clúster gestionado, comprometiendo potencialmente su integridad."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.11::el9"
],
"versions": [
{
"version": "1787688827",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.13::el9"
],
"versions": [
{
"version": "1787682112",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.14::el9"
],
"versions": [
{
"version": "1787682033",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"versions": [
{
"version": "1787681674",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.16::el9"
],
"versions": [
{
"version": "1787681686",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhacm2/acm-search-v2-rhel9",
"cpes": [
"cpe:/a:redhat:acm:2.17::el9"
],
"versions": [
{
"version": "1787681651",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 4.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T13:35:34.370769Z",
"id": "CVE-2026-71473",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-915"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:60386",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60387",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60388",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60389",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60390",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60391",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-71473",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512152",
"source": "[email protected]"
}
]
}