A flaw in the Search-v2-Operator component allows its search-serviceaccount to impersonate any user or group cluster-wide. Because the service account holds unrestricted impersonation rights, an attacker who compromises any pod deployed under this account can elevate privileges to system:masters, effectively taking full control of the Kubernetes cluster. This breach represents a classic case of improper privilege escalation (CWE-269) and could lead to widespread data loss, unauthorized deployment, or service disruption.

The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes version 2. No explicit version exclusions or patch levels are listed in the CNA data, so all instances of AC-M v2 that still use the default search-serviceaccount configuration are potentially impacted. The affected component resides in four pods that share the same service account.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS information is not available, and the vulnerability has not yet been listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that active exploitation is not confirmed. However, the likely attack vector is gaining foothold in any pod running under the search-serviceaccount; once inside, an attacker can invoke the impersonation API to obtain system:masters privileges. Because the impersonation permissions are granted at the cluster level, a single compromised pod could compromise the entire cluster.