CVE-2026-71469: Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).
Other sources
Cache.tokenReviews is a map[string]tokenReviewCache keyed by the raw bearer token string (tokenReview.go:39). On every distinct token -- valid or not -- GetTokenReview inserts a new entry before the API call and never deletes it. StartBackgroundValidation watches Namespaces and ManagedClusters but has only TODO comments for token cache cleanup. An unauthenticated attacker can exhaust the search-api pod's memory by sending requests with unique random bearer tokens, each of which creates a permanent cache entry.
Upstream: stolostron/search-v2-api
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71469?
The severity of CVE-2026-71469 is classified as high with a score of 7.5.
How does CVE-2026-71469 work?
CVE-2026-71469 allows an unauthenticated attacker to exploit the unbounded tokenReviews cache by sending requests with unique random bearer tokens.
What impact does CVE-2026-71469 have on systems?
The impact of CVE-2026-71469 can lead to memory exhaustion of the search-api, resulting in denial of service.
How can I mitigate CVE-2026-71469?
To mitigate CVE-2026-71469, implement proper cache size limits and token management strategies to prevent memory exhaustion.
Is CVE-2026-71469 exploitable without authentication?
Yes, CVE-2026-71469 is exploitable by unauthenticated attackers, making it a critical vulnerability.