CVE-2026-71471: Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.
Other sources
A single hub-side Search CR field (Collector.ImageOverride) selects the container image deployed to all managed clusters via addon-framework ManifestWork. The spoke pod runs under a ClusterRole granting / get/list/watch (FIND-006), so this is fleet-wide secret-read RCE. The addon.go:55 default comes from env COLLECTORIMAGE, and the package-global is mutated without restart on first reconcile only. A hub admin or any principal with patch access to the Search CR can replace the collector image across the entire fleet.
Upstream: stolostron/search-v2-operator
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71471?
The severity of CVE-2026-71471 is rated as critical with a score of 9.
How do I fix CVE-2026-71471?
To fix CVE-2026-71471, ensure that administrative access to the Search Custom Resource is tightly controlled and apply the latest patches from the vendor.
What are the potential impacts of CVE-2026-71471?
The potential impacts of CVE-2026-71471 include the deployment of arbitrary container images by attackers with administrative privileges.
Who is affected by CVE-2026-71471?
CVE-2026-71471 affects deployments of acm-search-v2-rhel9 where administrative users have patch access to the Search Custom Resource.
Is CVE-2026-71471 easy to exploit?
Yes, CVE-2026-71471 can be easily exploited by an attacker with administrative privileges on the hub cluster.