CVE-2026-71468: Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.
Other sources
cachedFedConfig is a package-level singleton with no per-user keying (fedConfig.go:35). When getFederationConfig refreshes the cache, it captures the current request's bearer token and reuses it for all subsequent federated requests until the cache TTL expires. This means the first user to trigger a cache miss after TTL expiry donates their token to all subsequent federated queries by other users, enabling cross-user data access to remote managed hub search results.
Precondition: FEATUREFEDERATEDSEARCH=true (default off; enabled for Global Hub deployments) and at least one remote managed hub configured with a search-global ManagedServiceAccount Secret.
Upstream: stolostron/search-v2-api
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable federated search by setting FEATURE_FEDERATED_SEARCH=false (the default is off). This prevents cross-user bearer-token reuse that occurs when FEATURE_FEDERATED_SEARCH=true for Global Hub deployments.
acm-search-v2-api-rhel9 (search-v2-api) FEATURE_FEDERATED_SEARCH = false - Compensating control
If FEATURE_FEDERATED_SEARCH must remain enabled for Global Hub deployments, restrict access to remote managed hub search results so that only the same intended user/context can query them (e.g., enforce authorization controls at the API layer / network path) to mitigate cross-user data access caused by the shared federated-config cache until a fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71468?
CVE-2026-71468 has a medium severity rating of 5.3.
How do I fix CVE-2026-71468?
To fix CVE-2026-71468, update to the patched version of acm-search-v2-api-rhel9 provided by Red Hat.
What impact does CVE-2026-71468 have?
CVE-2026-71468 allows other authenticated users to gain unauthorized access to remote managed hubs through bearer token reuse.
Which software is affected by CVE-2026-71468?
CVE-2026-71468 affects the Red Hat acm-search-v2-api-rhel9 software.
When was CVE-2026-71468 published?
CVE-2026-71468 was published on August 11, 2026.