EUVD-2026-63091
GHSA-4vrw-8fx2-pj82
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
PR:H reflects the requirement for a registered cluster credential; S:C because cross-cluster data is affected; I:H for tamper/delete of owned data; C:N and A:N as no confidentiality breach or denial of service is described.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.
AnalysisAI
Cross-cluster data integrity violation in Red Hat Advanced Cluster Management for Kubernetes 2 allows a registered and authenticated managed cluster to tamper with or delete indexed search data belonging to other clusters. The flaw resides in the delta-sync write paths of the search-indexer component, which fails to enforce cluster-scoped ownership checks before processing UPDATE and DELETE operations. With no public exploit identified at time of analysis and no CISA KEV listing, the practical risk is bounded by the requirement for an already-registered cluster credential, though the Changed scope (S:C) elevates concern in multi-tenant fleet environments where cluster isolation is an assumed security boundary.
Technical ContextAI
The affected component is search-indexer, a data aggregation and indexing service within Red Hat Advanced Cluster Management for Kubernetes 2 (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2). RHACM implements a hub-and-spoke model where managed clusters push state data - including resource inventories - to a central hub via synchronization channels. The delta-sync write path handles incremental updates from these clusters. The root cause maps to CWE-693 (Protection Mechanism Failure): the write path does not validate that the UID prefix embedded in submitted records matches the identity of the calling cluster before committing UPDATE or DELETE operations. Because cluster identity in this path is expressed through structured UID strings, an attacker can forge the prefix component to target a different cluster's data partition. This is an authorization control gap, not an authentication bypass - the calling cluster must be legitimately registered.
RemediationAI
No exact patched version was confirmed in the available input data; the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-76827 should be consulted for the authoritative fix version and errata. Until a patch is applied, operators should restrict which clusters are permitted to register with the RHACM hub to only fully trusted, internally managed clusters, eliminating the rogue-cluster registration vector. Network-level controls should limit direct access to search-indexer delta-sync endpoints to the hub's internal network plane, preventing direct endpoint manipulation from cluster workload namespaces. Audit logs for unexpected cluster UID prefixes appearing in delta-sync write requests should be reviewed as an interim detection measure. Admins should also evaluate whether the search index data for individual clusters can be isolated with stronger namespace or RBAC policies at the hub level pending vendor guidance on the root cause fix.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bund
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today