REDHAT-BUG-2512147: Medium severity stolostron search-v2-api vulnerability
cachedFedConfig is a package-level singleton with no per-user keying (fedConfig.go:35). When getFederationConfig refreshes the cache, it captures the current request's bearer token and reuses it for all subsequent federated requests until the cache TTL expires. This means the first user to trigger a cache miss after TTL expiry donates their token to all subsequent federated queries by other users, enabling cross-user data access to remote managed hub search results.
Precondition: FEATUREFEDERATEDSEARCH=true (default off; enabled for Global Hub deployments) and at least one remote managed hub configured with a search-global ManagedServiceAccount Secret.
Upstream: stolostron/search-v2-api
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512147?
The severity of REDHAT-BUG-2512147 is classified as medium.
How do I fix REDHAT-BUG-2512147?
To fix REDHAT-BUG-2512147, ensure that per-user keying is implemented for the cachedFedConfig to prevent bearer token reuse.
What are the risks associated with REDHAT-BUG-2512147?
The risks associated with REDHAT-BUG-2512147 include unauthorized access due to bearer token reuse across federated requests.
What software is affected by REDHAT-BUG-2512147?
The software affected by REDHAT-BUG-2512147 is the stolostron search-v2-api.
When was REDHAT-BUG-2512147 published?
REDHAT-BUG-2512147 was published on August 6, 2026.