A flaw in the acm-search-v2-rhel9 component permits an authenticated user, such as a hub administrator or a Search Custom Resource (CR) editor, to inject arbitrary shell commands or SQL statements through the WORK_MEM parameter. This injection occurs because the supplied string is embedded directly into a bash script and an SQL query without proper validation. Successful exploitation results in code execution inside the privileged postgres pod, creating a pathway for an attacker to compromise the entire system.

The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes 2, specifically the acm-search-v2-rhel9 implementation. No specific revision or patch level is identified in the vendor data, so any installation of this version of the product with the search operator component is potentially impacted.

The CVSS score of 9.1 classifies this flaw as critical. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated role with permissions to edit Search CRs and relies on the privileged nature of the postgres pod to achieve code execution. The attack vector is likely internal for privileged operators, but the impact is full code compromise of the database container.