{
  "threat_severity" : "Important",
  "public_date" : "2026-08-19T15:00:00Z",
  "bugzilla" : {
    "description" : "acm-search-v2-rhel9: search-v2-operator: Search CR imageOverride/arguments/envVar flow unsanitized into pods running impersonating SA",
    "id" : "2512149",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2512149"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-913",
  "details" : [ "A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.", "A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions." ],
  "statement" : "This is an Important vulnerability in Red Hat Advanced Cluster Management for Kubernetes. The search-v2-operator allows a privileged attacker with Search CR edit permissions (PR:H) to inject arbitrary container images or mount sensitive secrets into pods, which can lead to a full cluster compromise due to the associated ServiceAccount's cluster-wide impersonation capabilities. Exploitation requires an already-privileged CR editor, which is why this does not meet the bar for Critical under the unauthenticated-RCE standard.",
  "package_state" : [ {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/acm-search-v2-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-71470\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71470" ],
  "name" : "CVE-2026-71470",
  "mitigation" : {
    "value" : "To mitigate this issue, restrict permissions for creating and modifying Search Custom Resources (CRs) to only trusted and authorized users. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit who can perform `create`, `update`, and `patch` operations on `search.search.open-cluster-management.io` resources. This reduces the attack surface by preventing unauthorized users from exploiting the unsanitized input flow.",
    "lang" : "en:us"
  },
  "csaw" : false
}