CVE-2026-71473: Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke
A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Other sources
addon-framework's GetValuesFromAddonAnnotation reads the addon.open-cluster-management.io/values annotation on a ManagedClusterAddOn and deep-merges arbitrary JSON into the Helm values. Because it is listed after getValue, it can override global.imageOverrides.searchcollector, org, fullnameOverride, etc. A user with patch managedclusteraddons permission in a single managed-cluster namespace can replace the collector image for that spoke without touching the hub Search CR, achieving container image injection on the managed cluster.
Upstream: stolostron/search-v2-operator
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71473?
The severity of CVE-2026-71473 is high with a score of 8.5.
How do I fix CVE-2026-71473?
To fix CVE-2026-71473, ensure that only trusted administrators have the necessary permissions to prevent injecting arbitrary configuration data.
What systems are affected by CVE-2026-71473?
CVE-2026-71473 affects the search-v2-operator component in managed cluster environments.
What type of vulnerability is CVE-2026-71473?
CVE-2026-71473 is a vulnerability that allows a user with specific administrative permissions to inject arbitrary configuration data.
What can an attacker achieve with CVE-2026-71473?
An attacker can exploit CVE-2026-71473 to override critical settings, potentially compromising the integrity of the affected containers.