CVE-2026-71470: Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa
A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs privileged access to edit the Search custom resource. The issue is not described as exploitable by an unauthenticated or low-privileged user.
What level of impact can successful exploitation have?
A CR editor can inject environment variables or replace the search container image, potentially exposing arbitrary secrets to that container. Because the ServiceAccount has extensive impersonation permissions, this can lead to privilege escalation and full cluster compromise.
What configuration elements should be reviewed while awaiting a fix?
Review who can edit Search custom resources and restrict that permission to trusted administrators. Inspect Search CRs for use of imageOverride, arguments, and environment-variable fields, especially values that introduce unexpected images, commands, or secret-related configuration.