REDHAT-BUG-2512146: High severity stolostron/search-v2-api vulnerability
The authentication middleware in search-v2-api unconditionally skips authentication when the request carries an Upgrade: websocket header (pkg/rbac/authnMiddleware.go:21). The /federated subrouter applies only AuthenticateUser before HandleFederatedRequest, which is a plain JSON handler that never validates the WebSocket handshake, never re-checks the token, and never consults GetUserData. An unauthenticated attacker can send a standard HTTP POST to /federated with Upgrade: websocket to bypass authentication and query federated search results across all configured remote managed hubs.
Precondition: FEATUREFEDERATEDSEARCH=true (default off; enabled for Global Hub deployments).
Upstream: stolostron/search-v2-api
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512146?
The severity of REDHAT-BUG-2512146 is classified as high, with a score of 7.
What is the risk associated with REDHAT-BUG-2512146?
REDHAT-BUG-2512146 has a risk level of 33, indicating a significant potential impact if exploited.
What software is affected by REDHAT-BUG-2512146?
The vulnerability REDHAT-BUG-2512146 affects the stolostron/search-v2-api software.
How does REDHAT-BUG-2512146 affect authentication?
REDHAT-BUG-2512146 allows unauthenticated access when a request includes an 'Upgrade: websocket' header.
How do I fix REDHAT-BUG-2512146?
To remediate REDHAT-BUG-2512146, ensure that authentication is enforced for WebSocket upgrade requests.