What is the CVSS score of CVE-2026-70496?

CVE-2026-70496 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Red Hat ACM are affected by CVE-2026-70496?

Red Hat Advanced Cluster Management for Kubernetes 2 contains a critical privilege escalation vulnerability (CVE-2026-70496) that could allow attackers with limited cluster access to gain complete…

How to fix or mitigate CVE-2026-70496?

Within 24 hours, identify and document all Red Hat Advanced Cluster Management for Kubernetes 2 deployments and their current versions. Within 7 days, implement network segmentation to restrict operator service account reach, enforce RBAC policies limiting operator permissions to least-privilege principle, and enable comprehensive audit logging to detect suspicious impersonation or RBAC modification attempts. Within 30 days, establish monitoring for Red Hat security updates and develop an emergency patching procedure for immediate application once patches for CVE-2026-70496 become available.

Red Hat ACM CVE-2026-70496

EUVD-2026-62678 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-08-19 redhat

GHSA-xg68-vc28-3f79

Privilege Escalation Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

9.9

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Attacker needs the operator's low-privileged identity (PR:L) reachable via the API (AV:N/AC:L); abusing it crosses into cluster-admin scope (S:C) with full C/I/A loss across hub and managed clusters.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 18:46 vuln.today

CVE Published

Aug 19, 2026 - 18:16 cve.org

CRITICAL 9.9

DescriptionCVE.org

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.

AnalysisAI

Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bound to a ClusterRole with cluster-administrator-equivalent permissions - including user impersonation, RBAC write, Certificate Signing Request approval, and ManifestWork management. An attacker who gains control of the operator's service account (a low-privileged cluster foothold) can leverage these excessive grants to take over the entire hub cluster and its managed clusters. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.9 rating reflects the near-total loss of cluster control if the operator identity is abused.

Technical ContextAI

Red Hat Advanced Cluster Management (RHACM) is a multi-cluster management platform built on Kubernetes/OpenShift; the search-v2-operator provides its search-and-indexing capability for cluster resources. The root cause is CWE-250 (Execution with Unnecessary Privileges): the operator's ClusterRole was over-scoped rather than following least privilege. The specifically dangerous verbs are 'impersonate' (assume any user/group/service-account identity), write access to RBAC objects (Roles/ClusterRoles/bindings), 'approve' on certificatesigningrequests (mint trusted client certs, including cluster-admin identities), and control over ManifestWork - the RHACM primitive that pushes arbitrary manifests to managed spoke clusters. Any one of these effectively confers cluster-admin; together they allow lateral movement from the hub to every managed cluster. Affected CPE is red_hat:red_hat_advanced_cluster_management_for_kubernetes_2.

RemediationAI

No vendor-released patch version is identified in the available data; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-70496 and Bugzilla 2511032 for the errata and fixed build, then upgrade the search-v2-operator to the corrected release once published. As a compensating control before patching, tighten the operator's ClusterRole to remove the excessive verbs - specifically drop 'impersonate', write access to RBAC resources, 'approve' on certificatesigningrequests, and broad ManifestWork permissions - scoping it to only the resources search indexing requires; note this may break search functionality until the fixed operator ships, so validate in staging. Additionally restrict who can read the operator's service-account token, enable audit logging on impersonation and CSR-approval events, and apply admission policies (e.g., preventing pods from mounting that service account) to reduce the chance the identity is stolen.