Description
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Published: 2026-08-12
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the search-v2-operator component of Red Hat Advanced Cluster Management for Kubernetes 2 permits a user with certain administrative permissions on a managed cluster to inject arbitrary configuration data. The injected data can override critical settings, ultimately resulting in the replacement of container images and thereby compromising the cluster’s image integrity.

Affected Systems

Red Hat Advanced Cluster Management for Kubernetes version 2 is affected. Specific affected version ranges are not listed; any instance of version 2 of the product could potentially expose the vulnerability.

Risk and Exploitability

The vulnerability is scored as CVSS 8.5, indicating high severity, and is not currently listed in the CISA KEV catalog. The EPSS score is unavailable, leaving exact exploit likelihood uncertain. The attack vector is privilege‑based: a user who already has specific administrative rights on a managed cluster can exploit the flaw by using the addonfactory.getvaluesfromaddonannotation functionality to override helm values. Because the flaw enables container image injection, the risk to confidentiality, integrity, and availability is significant for affected clusters.

Generated by OpenCVE AI on August 13, 2026 at 02:29 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat Advanced Cluster Management for Kubernetes 2 update that addresses the search‑v2‑operator flaw as soon as it is available.
  • Restrict administrative permissions to only trusted users; prevent untrusted administrators from using addonfactory.getvaluesfromaddonannotation.
  • Monitor Helm values and cluster configuration for unexpected changes; alert administrators when overrides occur.

Generated by OpenCVE AI on August 13, 2026 at 02:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Thu, 13 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 13 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Wed, 12 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Title Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke
First Time appeared Redhat
Redhat acm
Weaknesses CWE-915
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-27T02:16:44.596Z

Reserved: 2026-08-06T19:34:07.970Z

Link: CVE-2026-71473

cve-icon Vulnrichment

Updated: 2026-08-13T13:35:38.347Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T22:17:16.020

Modified: 2026-08-27T04:16:47.980

Link: CVE-2026-71473

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-12T20:00:00Z

Links: CVE-2026-71473 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:15:07Z

Weaknesses
  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes