EUVD-2026-57686
GHSA-j9xr-mxxr-3948
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Requires hub-admin patch access to the Search CR so PR:H; network-reachable API with low complexity; fleet-wide arbitrary container yields full C/I/A and crosses into managed clusters, so S:C and A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.
AnalysisAI
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search collector) allows a hub-cluster administrator holding patch access to the Search Custom Resource to abuse the unvalidated Collector.ImageOverride field to push an attacker-chosen container image to every managed cluster in the fleet. Because the override is trusted and propagated hub-to-spoke, a single malicious CR edit yields command execution across all connected clusters, with the CVSS scope-change flag reflecting the jump from the hub trust boundary into separate managed-cluster security authorities. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires administrative privileges on the RHACM hub cluster, specifically RBAC permission to patch/update the Search Custom Resource (the Collector.ImageOverride field), and a container image the collectors can pull from a reachable registry. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) captures a genuinely high-impact but privilege-gated flaw: network reachable and low complexity, but requiring PR:H - full administrative, patch-level access to the Search CR on the hub. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised hub-cluster administrator (or an attacker who has phished/escalated to that role) edits the Search Custom Resource and sets Collector.ImageOverride to a container image they control hosting a reverse shell. RHACM propagates the override, and the collector on every managed cluster pulls and runs the attacker image, giving simultaneous command execution across the entire fleet. … |
| Remediation | Apply the Red Hat security errata for acm-search-v2-rhel9 as published on the advisory page https://access.redhat.com/security/cve/CVE-2026-71471; the exact fixed RHACM 2.x version is not stated in the available data (no vendor-released patch version independently confirmed from the provided input), so consult that advisory and the Bugzilla tracker https://bugzilla.redhat.com/show_bug.cgi?id=2512150 for the errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Red Hat ACM 2 deployments and document the current version of the acm-search-v2-rhel9 search collector; immediately restrict edit access to the Search Custom Resource (CR) to only essential administrators and review audit logs for any recent CR modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today