CVE-2026-71467: Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing
A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated endpoint with the Upgrade: websocket header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.
Other sources
The authentication middleware in search-v2-api unconditionally skips authentication when the request carries an Upgrade: websocket header (pkg/rbac/authnMiddleware.go:21). The /federated subrouter applies only AuthenticateUser before HandleFederatedRequest, which is a plain JSON handler that never validates the WebSocket handshake, never re-checks the token, and never consults GetUserData. An unauthenticated attacker can send a standard HTTP POST to /federated with Upgrade: websocket to bypass authentication and query federated search results across all configured remote managed hubs.
Precondition: FEATUREFEDERATEDSEARCH=true (default off; enabled for Global Hub deployments).
Upstream: stolostron/search-v2-api
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable federated search by setting FEATURE_FEDERATED_SEARCH=false. (It is default off; enabled only for Global Hub deployments.)
search-v2-api FEATURE_FEDERATED_SEARCH = false - Compensating control
Block or restrict requests to the /federated endpoint that include the header `Upgrade: websocket` at the network layer (e.g., WAF/ingress/proxy/firewall rules), since authentication is unconditionally skipped when this header is present.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71467?
CVE-2026-71467 has a severity rating of 7.5, indicating a high risk level.
What vulnerability does CVE-2026-71467 describe?
CVE-2026-71467 describes an authentication bypass vulnerability in search-v2-api that occurs due to websocket header spoofing.
How can an attacker exploit CVE-2026-71467?
An attacker can exploit CVE-2026-71467 by sending a specially crafted HTTP POST request to the /federated endpoint with an Upgrade: websocket header.
How do I fix CVE-2026-71467?
To fix CVE-2026-71467, ensure that authentication checks are enforced regardless of the presence of an Upgrade: websocket header.
What software is affected by CVE-2026-71467?
CVE-2026-71467 affects the search-v2-api component on RHEL9.