EUVD-2026-56897
GHSA-8x2m-938h-j94g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no privileges and trivial complexity; only confidentiality impacted via unauthenticated federated search result access.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated endpoint with the Upgrade: websocket header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.
AnalysisAI
Authentication bypass in Red Hat's search-v2-api exposes federated search results to unauthenticated remote attackers. The authentication middleware unconditionally skips validation when an HTTP request carries the Upgrade: websocket header, allowing any network-reachable attacker to POST to the /federated endpoint without credentials. Exploitation yields information disclosure across all configured remote managed hubs - no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis, but the CVSS 7.5 score and PR:N vector reflect low-barrier, network-accessible exploitation.
Technical ContextAI
The vulnerability resides in the authentication middleware of search-v2-api, a Red Hat component that aggregates search across federated managed hubs. CWE-287 (Improper Authentication) describes the root cause: a logic flaw where the middleware evaluates the presence of the Upgrade: websocket HTTP header as an implicit bypass signal rather than enforcing authentication regardless of request headers. WebSocket upgrade requests are standard HTTP/1.1 requests that begin as plain HTTP before protocol switching - treating them as exempt from authentication is a design error. The /federated endpoint is the specific attack surface, as it proxies or aggregates search queries to all configured remote hubs, amplifying the scope of information disclosure beyond a single system.
Affected ProductsAI
The affected product is search-v2-api as reported by Red Hat (secalert@redhat.com) and tracked under EUVD-2026-56897. No specific version range or CPE strings were provided in the available intelligence. Affected version details should be confirmed via the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-71467 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2512146.
RemediationAI
The primary remediation is to apply the vendor-released patch per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71467 - exact fix versions should be confirmed there, as no patched version number was present in the available intelligence. As a compensating control prior to patching, restrict network access to the /federated endpoint using an API gateway, reverse proxy, or firewall rule to allow only authenticated internal clients or trusted IP ranges; note this does not fix the underlying middleware flaw and may affect legitimate federated search functionality. Additionally, a WAF rule can be deployed to reject or flag HTTP POST requests to /federated that carry an Upgrade: websocket header from untrusted sources. Disabling the /federated endpoint entirely is the most effective workaround if federated hub search is not operationally required, at the cost of losing cross-hub search capability.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today