EUVD-2026-62678
GHSA-xg68-vc28-3f79
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs the operator's low-privileged identity (PR:L) reachable via the API (AV:N/AC:L); abusing it crosses into cluster-admin scope (S:C) with full C/I/A loss across hub and managed clusters.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
AnalysisAI
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already control or be able to act as the search-v2-operator's service account on the RHACM hub cluster - for example by compromising a workload that mounts that token or by holding low-level cluster access that can reach the operator identity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is driven by the scope change and the fact that limited existing privileges convert into full cluster compromise; the network attack vector reflects that the Kubernetes API is the interface, though in practice the attacker must first obtain the operator's service-account token. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a pod or gained a low-privileged foothold that can use the search-v2-operator's service account calls the Kubernetes API using the operator identity, then invokes its 'impersonate' or RBAC-write permissions to grant themselves cluster-admin. From the RHACM hub they abuse ManifestWork to push malicious manifests to every managed spoke cluster. … |
| Remediation | No vendor-released patch version is identified in the available data; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-70496 and Bugzilla 2511032 for the errata and fixed build, then upgrade the search-v2-operator to the corrected release once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Red Hat Advanced Cluster Management for Kubernetes 2 deployments and their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today