CVE-2026-76827

Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

Published Aug 19, 2026 CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.

Analysis

Technical impact

The flaw in search-indexer allows an authenticated managed cluster to perform UPDATE or DELETE operations on indexed search data that belong to a different cluster. It occurs because delta-sync write paths fail to restrict those modifications to data owned by the calling cluster. An attacker can craft user identifiers with another cluster’s prefix to target unrelated data, causing integrity loss or data deletion.

Affected Systems

Red Hat Advanced Cluster Management for Kubernetes version 2 (ACM 2). The vulnerability applies to all deployments of this product until a vendor patch is released.

Risk and Exploitability

The CVSS base score of 6.8 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires a registered and authenticated managed cluster with knowledge of another cluster’s UID prefix, making it an intra-tenant attack that may be limited to environments where multiple clusters coexist. While no public exploits are currently known, the ability to tamper with or delete search data could disrupt search services and compromise data integrity for affected tenants.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.11

affected

Version	Status	Constraints
`1787688957`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.13

affected

Version	Status	Constraints
`1787262474`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.14

affected

Version	Status	Constraints
`1787250074`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.15

affected

Version	Status	Constraints
`1787249293`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.16

affected

Version	Status	Constraints
`1787248491`	unaffected	< *

Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.17

affected

Version	Status	Constraints
`1787247085`	unaffected	< *

No data.

Vendor Product Versions

Redhat

Advanced Cluster Management For Kubernetes

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

Apply the official Red Hat security patch for ACM 2 as soon as it becomes available.
Since no official workaround exists, isolate search-indexer endpoints from unauthorized cross‑cluster access by applying network segmentation and restricting service ports to each cluster’s own namespace.
Regularly review Red Hat security advisories for any future mitigations or patches.

Generated by OpenCVE AI on August 20, 2026 at 11:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.525% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60387
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60391
https://access.redhat.com/security/cve/CVE-2026-76827
https://bugzilla.redhat.com/show_bug.cgi?id=2519896
https://nvd.nist.gov/vuln/detail/CVE-2026-76827
https://www.cve.org/CVERecord?id=CVE-2026-76827

History

Aug 27, 2026 4:00 AM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:acm:2.11::el9 cpe:/a:redhat:acm:2.14::el9 cpe:/a:redhat:acm:2.16::el9
References		https://access.redhat.com/errata/RHSA-2026:60387 https://access.redhat.com/errata/RHSA-2026:60388 https://access.redhat.com/errata/RHSA-2026:60391

Aug 26, 2026 11:15 PM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:acm:2~~	cpe:/a:redhat:acm:2.13::el9 cpe:/a:redhat:acm:2.15::el9 cpe:/a:redhat:acm:2.17::el9
References		https://access.redhat.com/errata/RHSA-2026:60386 https://access.redhat.com/errata/RHSA-2026:60389 https://access.redhat.com/errata/RHSA-2026:60390

Aug 21, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat advanced Cluster Management For Kubernetes
Vendors & Products		Redhat advanced Cluster Management For Kubernetes

Aug 21, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 20, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-76827 https://www.cve.org/CVERecord?id=CVE-2026-76827
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 19, 2026 9:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.
Title		Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)
First Time appeared		Redhat Redhat acm
Weaknesses		CWE-693
CPEs		cpe:/a:redhat:acm:2
Vendors & Products		Redhat Redhat acm
References		https://access.redhat.com/security/cve/CVE-2026-76827 https://bugzilla.redhat.com/show_bug.cgi?id=2519896
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N'}`