What is the CVSS score of CVE-2026-71473?

CVE-2026-71473 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Red Hat ACM are affected by CVE-2026-71473?

A high-severity vulnerability in Red Hat Advanced Cluster Management 2 (RHACM 2) enables authenticated cluster administrators to inject arbitrary container images across managed Kubernetes clusters,…

How to fix or mitigate CVE-2026-71473?

Within 24 hours: inventory all RHACM 2 deployments and identify users with cluster administrator privileges on managed clusters; audit role assignments for necessity and justify retention. Within 7 days: implement RBAC restrictions to limit cluster admin access, enable container image scanning and signature validation on all managed clusters, and deploy audit logging to monitor image deployment changes; monitor Red Hat Security Advisory channels for patch release. Within 30 days: complete mitigations across all clusters, perform forensic review of running container images for suspicious artifacts, and establish ongoing registry and configuration change monitoring; apply patch immediately upon vendor release after staging validation.

Red Hat ACM CVE-2026-71473

EUVD-2026-57685 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-08-12 redhat

GHSA-mm7v-f498-mqrj

Code Injection Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

8.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

9.6 CRITICAL

Container image replacement constitutes full workload integrity compromise warranting I:H; PR:L reflects required specific admin credentials; S:C captures cross-cluster boundary impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Red Hat

8.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 22:19 vuln.today

CVE Published

Aug 12, 2026 - 21:40 cve.org

HIGH 8.5

DescriptionCVE.org

A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.

AnalysisAI

Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting near-term opportunistic risk, though the insider or compromised-privileged-account threat model remains credible given the PR:L access requirement.

Technical ContextAI

The search-v2-operator is a Kubernetes operator component within Red Hat Advanced Cluster Management for Kubernetes 2 (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2). Kubernetes operators follow the controller-reconciliation pattern, watching custom resource definitions (CRDs) and reconciling cluster state - making them privileged actors that can modify workload specifications across managed clusters. CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) represents a mass assignment class of vulnerability where externally-supplied data populates object properties without adequate field-level restriction, allowing unexpected or attacker-controlled fields to override sensitive internal settings such as container image references. In this context, the search-v2-operator fails to sufficiently restrict which configuration fields a low-privileged administrative user can influence, enabling injection of attacker-controlled image references that the operator then faithfully applies to managed cluster workloads during its reconciliation loop.

RemediationAI

No specific patched version has been identified from the available references at time of analysis; patch status and exact fix version must be confirmed against the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-71473. As compensating controls pending a confirmed patch, administrators should immediately audit and revoke any unnecessary 'specific administrative permissions' on managed clusters, since exploitation requires exactly these delegated roles - reducing this access surface directly eliminates the exploitation prerequisite, with the trade-off of potential operational disruption for teams relying on delegated cluster-admin workflows. Deploying admission controllers (OPA/Gatekeeper or Kyverno) with policies that restrict container image sources to approved registries on managed clusters would constrain the blast radius of a successful injection, though this adds policy maintenance overhead. Enabling Kubernetes API audit logging and alerting on unexpected writes to search-v2-operator custom resources or changes to image fields provides detection capability without blocking operations. Track the Bugzilla issue at https://bugzilla.redhat.com/show_bug.cgi?id=2512152 for patch availability updates.