CVE-2026-71468 is a moderate severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes (acm-search-v2-api-rhel9). The getFederationConfig function improperly reuses a user's bearer token when refreshing its cache, causing cross-user bearer-token reuse. This leads to unauthorized access to remote managed hub search results by other authenticated users. Exploitation requires the FEATURE_FEDERATED_SEARCH feature to be enabled, which is off by default. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment).

The vulnerability allows authenticated users to gain unauthorized access to search results from remote managed hubs, leading to information disclosure. There is no impact on integrity or availability. The attack complexity is high and requires low privileges. User interaction is not required. The scope remains unchanged.

Red Hat advises ensuring that the FEATURE_FEDERATED_SEARCH is not enabled if federated search functionality is not required, as it is disabled by default. If enabled, consider disabling this feature to prevent unauthorized cross-user data access. Disabling this feature will impact federated search capabilities across managed hubs. No official patch or fix is currently provided; patch status is not yet confirmed — check the vendor advisory for updates.