EUVD-2026-57685
GHSA-mm7v-f498-mqrj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Container image replacement constitutes full workload integrity compromise warranting I:H; PR:L reflects required specific admin credentials; S:C captures cross-cluster boundary impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
AnalysisAI
Container image injection in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) allows a low-privileged authenticated user with specific administrative permissions on a managed cluster to exploit the search-v2-operator component's improper configuration handling, overriding container image settings and deploying arbitrary images across the managed cluster. The CVSS 8.5 score reflects a scope-changed impact (S:C) where the breach crosses from the search operator into the broader managed cluster workload environment, enabling a supply chain-style compromise of running containers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user account with 'specific administrative permissions' on the RHACM-managed cluster, as stated explicitly in the CVE description; the CVSS PR:L metric confirms authentication with elevated (though not full cluster-admin) privilege is required - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 score is primarily driven by the scope change (S:C) and high confidentiality impact (C:H), reflecting cross-boundary exploitation from within the managed cluster into the broader workload environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a compromised administrative account with delegated managed-cluster permissions - consistent with an insider threat or credential-phishing scenario - crafts a malicious configuration payload targeting the search-v2-operator via the Kubernetes API, injecting an attacker-controlled container image reference into an operator-watched configuration object. The search-v2-operator, improperly accepting the injected field during its reconciliation loop, applies the attacker-supplied image to running workloads on the managed cluster, replacing legitimate containers with attacker-controlled images without triggering additional privilege escalation. … |
| Remediation | No specific patched version has been identified from the available references at time of analysis; patch status and exact fix version must be confirmed against the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-71473. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all RHACM 2 deployments and identify users with cluster administrator privileges on managed clusters; audit role assignments for necessity and justify retention. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today