EUVD-2026-60361
GHSA-q7g5-25j5-rf23
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Pod-local access to service account token is AV:L/PR:L; cluster-wide system:masters impersonation causes S:C with full CIA impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve system:masters access, granting them full control over the cluster.
AnalysisAI
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod execution under the search-serviceaccount service account to impersonate system:masters and gain full cluster-admin control. The search-serviceaccount RBAC bindings grant cluster-wide impersonate permissions on users and groups - a grossly over-privileged configuration that collapses the entire cluster's security boundary if any pod running under this account is compromised. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to first achieve code execution within any pod that runs under the `search-serviceaccount` service account in an RHACM 2.x cluster (AV:L, PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H scoring 8.8 is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained code execution in any RHACM search-operator pod - through a separate container vulnerability, a compromised image in the supply chain, or lateral movement from another cluster workload - reads the automatically mounted service account token at `/var/run/secrets/kubernetes.io/serviceaccount/token`. Using standard `kubectl` or direct Kubernetes API calls with the `Impersonate-Group: system:masters` HTTP header and the service account bearer token, the attacker bypasses all RBAC checks and issues cluster-admin commands - listing and exfiltrating all secrets across namespaces, deploying backdoor workloads, or deleting critical infrastructure. … |
| Remediation | Apply the vendor-supplied patch from Red Hat as the primary fix; consult https://access.redhat.com/security/cve/CVE-2026-70495 and https://bugzilla.redhat.com/show_bug.cgi?id=2511031 for the specific patched RHACM 2.x release version, which is not independently confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and immediately restrict the search-serviceaccount RBAC bindings to the absolute minimum required permissions, removing the over-privileged impersonate grants on system:masters and user/group resources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today