CVE-2026-71471 is a critical vulnerability in acm-search-v2-rhel9, specifically in the Collector.ImageOverride field of the Search Custom Resource (CR) within Red Hat Advanced Cluster Management for Kubernetes. An attacker with high privileges on the hub cluster and patch access to the Search CR can replace the collector image, causing arbitrary container images to be deployed across all managed clusters. This results in remote code execution (RCE) and potential secret exfiltration across the entire fleet. The vulnerability is due to the propagation of the Collector.ImageOverride field to all managed clusters, allowing malicious container images to run with elevated privileges.

The vulnerability allows a highly privileged user on the hub cluster to execute arbitrary code remotely across all managed clusters by deploying malicious container images. This can lead to full compromise of the managed clusters, including execution of commands and access to sensitive information such as secrets. The scope of impact is fleet-wide, affecting all clusters managed by the vulnerable hub.

Red Hat advises restricting patch access to the Search Custom Resource (CR) strictly to trusted and authorized hub administrators. This limits the ability to modify the Collector.ImageOverride field and prevents unauthorized deployment of arbitrary container images. No official patch or fix is currently indicated in the advisory; therefore, access control is the primary mitigation. Users should monitor the Red Hat advisory for updates regarding patches or official fixes.