What is the CVSS score of EUVD-2026-60362?

EUVD-2026-60362 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Red Hat ACM are affected by EUVD-2026-60362?

Red Hat Advanced Cluster Management for Kubernetes 2 contains a critical command and SQL injection vulnerability (CVSS 9.1) allowing authenticated administrators to execute arbitrary code within…

How to fix or mitigate EUVD-2026-60362?

Within 24 hours, inventory all production instances of Red Hat Advanced Cluster Management acm-search-v2-rhel9 across your environment, identify personnel with hub administrator or Search Custom Resource editor roles, and audit the past 30 days of administrative activity logs for WORK_MEM parameter changes. Within 7 days, implement network segmentation policies restricting PostgreSQL pod access to only essential services, enable audit logging for all administrative configuration changes with alerting on suspicious parameters, and reduce the scope of users holding hub administrator privileges to essential personnel only with enforced multi-factor authentication. Within 30 days, establish a formal patch upgrade plan with Red Hat for when fixes become available, conduct security testing of administrative access controls once patched versions are released, and implement infrastructure-as-code guardrails preventing direct pod access.

Red Hat ACM EUVD-2026-60362

| CVE-2026-71472 CRITICAL

OS Command Injection (CWE-78)

2026-08-17 redhat

GHSA-gqg9-92w2-w94m

RCE PostgreSQL Command Injection Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

9.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Reachable via the Kubernetes API (AV:N) with low complexity, but requires hub-admin/Search CR editor rights (PR:H); injection breaks out of the tenant role into the privileged postgres pod, justifying S:C and full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 20:05 vuln.today

CVE Published

Aug 17, 2026 - 19:28 cve.org

CRITICAL 9.1

DescriptionCVE.org

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.

Articles & Coverage 2

News 3 New PostgreSQL Vulnerabilities - 1 Critical, 2 High Severity Aug 18, 2026 News Critical SQL/Command Injection in PostgreSQL (ACM Search) - CVE-2026-71472 Aug 17, 2026

AnalysisAI

Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.

Technical ContextAI

The affected component is the search subsystem of Red Hat ACM (per CPE cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2), which indexes cluster state into a backing PostgreSQL database running as a privileged pod. Operators tune the search indexer through a Search Custom Resource (CR); the WORK_MEM parameter is meant to set the PostgreSQL work_mem memory sizing. The root cause is CWE-78 (OS Command Injection): the WORK_MEM string is interpolated into a shell script and an SQL statement without validation or parameterization, so shell metacharacters and SQL syntax in that field are interpreted rather than treated as a numeric value. Because the postgres pod runs with elevated privileges, code executed there can act on the database and potentially the surrounding container context.

RemediationAI

Patch available per vendor advisory: apply the fixed acm-search-v2-rhel9 image published by Red Hat once released, following the errata linked from https://access.redhat.com/security/cve/CVE-2026-71472 (exact fixed version is not stated in the available data, so verify the specific z-stream against the Red Hat errata and Bugzilla 2512151). As compensating controls until patched: tightly restrict who holds hub-administrator and Search CR edit permissions via Kubernetes RBAC (removing edit rights on the Search CR from non-essential users directly removes the attack surface, at the cost of operators needing an admin to change search tuning); audit existing Search CRs for anomalous WORK_MEM values containing shell metacharacters or SQL syntax; and monitor the postgres pod for unexpected process execution. Avoid delegating Search CR editing in multi-tenant hubs, accepting the trade-off of centralized tuning control.