CVE-2026-76827
Description
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.
Statement
This is a Moderate flaw in Red Hat Advanced Cluster Management for Kubernetes. The search-indexer's delta-sync write paths do not scope UPDATE/DELETE operations to the calling cluster, allowing a registered managed cluster to tamper with or delete another cluster's indexed search data by crafting UIDs with a different cluster's prefix. Exploitation requires already holding legitimate, authenticated managed-cluster credentials, which is why this does not reach Important severity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
PR:H reflects that exploitation requires already holding legitimate, authenticated managed-cluster (spoke) credentials -- not a low-bar authenticated user. This is a defense-in-depth cross-tenant write-scoping gap, independent of the separately-tracked missing-authentication/identity-binding findings.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
