What is the CVSS score of EUVD-2026-57686?

EUVD-2026-57686 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 1.5%.

Which versions of Red Hat ACM are affected by EUVD-2026-57686?

Red Hat Advanced Cluster Management for Kubernetes 2 contains a critical vulnerability in its search collector component that allows hub administrators to deploy malicious container images across an…

How to fix or mitigate EUVD-2026-57686?

Within 24 hours, identify all Red Hat ACM 2 deployments and document the current version of the acm-search-v2-rhel9 search collector; immediately restrict edit access to the Search Custom Resource (CR) to only essential administrators and review audit logs for any recent CR modifications. Over the next 7 days, implement network segmentation or ingress policies between the ACM hub cluster and managed clusters where operationally feasible, enable comprehensive audit logging on all Search CR modifications, and configure RBAC policies to granularly control which administrators can modify the Collector.ImageOverride field. Within 30 days, establish continuous monitoring of Red Hat vendor advisories for patch availability; once released, develop and test the patch in a non-production ACM environment and execute a controlled rollout across all affected production instances.

Red Hat ACM EUVD-2026-57686

| CVE-2026-71471 CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-08-12 redhat

GHSA-j9xr-mxxr-3948

RCE Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

9.0

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.1 CRITICAL

Requires hub-admin patch access to the Search CR so PR:H; network-reachable API with low complexity; fleet-wide arbitrary container yields full C/I/A and crosses into managed clusters, so S:C and A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 22:19 vuln.today

CVE Published

Aug 12, 2026 - 21:40 cve.org

CRITICAL 9.0

DescriptionCVE.org

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.

AnalysisAI

Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search collector) allows a hub-cluster administrator holding patch access to the Search Custom Resource to abuse the unvalidated Collector.ImageOverride field to push an attacker-chosen container image to every managed cluster in the fleet. Because the override is trusted and propagated hub-to-spoke, a single malicious CR edit yields command execution across all connected clusters, with the CVSS scope-change flag reflecting the jump from the hub trust boundary into separate managed-cluster security authorities. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.

Technical ContextAI

Red Hat Advanced Cluster Management (RHACM) is Red Hat's multi-cluster Kubernetes management layer that runs on OpenShift; the hub cluster centrally governs many managed (spoke) clusters. The affected component, acm-search-v2-rhel9, is the Search service whose collector agents run on each managed cluster to index Kubernetes resources. The Search Custom Resource exposes a Collector.ImageOverride field intended to let operators pin or substitute the collector container image. The root cause is CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere): the value supplied in ImageOverride is treated as trusted and is propagated from the hub to the collector workload on every managed cluster without restricting it to a vetted image, so an arbitrary registry reference becomes running code fleet-wide.

RemediationAI

Apply the Red Hat security errata for acm-search-v2-rhel9 as published on the advisory page https://access.redhat.com/security/cve/CVE-2026-71471; the exact fixed RHACM 2.x version is not stated in the available data (no vendor-released patch version independently confirmed from the provided input), so consult that advisory and the Bugzilla tracker https://bugzilla.redhat.com/show_bug.cgi?id=2512150 for the errata. As compensating controls until patched, tightly restrict RBAC so that patch/update verbs on the Search Custom Resource are granted only to a minimal set of trusted operators (removing broad hub cluster-admin grants), audit and alert on any modification to the Search CR's Collector.ImageOverride field, and enforce an admission policy (an admission webhook, OPA/Gatekeeper, or Kyverno rule) that pins collector images to an allowlist of trusted Red Hat registries and rejects arbitrary ImageOverride values. The trade-off of RBAC lockdown is reduced operational flexibility for teams that legitimately customize the collector image, and admission-policy pinning must be updated whenever Red Hat changes the official image reference.