This vulnerability exists in the acm-search-v2-rhel9 component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The flaw is due to improper neutralization of special elements in the WORK_MEM string supplied by an authenticated user in a Search Custom Resource. Because this input is used unsafely in both a bash script and an SQL query, an attacker with high privileges can execute arbitrary shell commands or SQL statements inside the privileged postgres pod. This can lead to complete compromise of the search service and potentially the entire cluster environment. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low complexity, high privileges required, no user interaction, and impacts to confidentiality, integrity, and availability with changed scope.

Successful exploitation allows an authenticated, highly privileged user to execute arbitrary OS commands and SQL statements within the privileged postgres pod. This can lead to full compromise of the search service and cluster-wide impersonation privileges, potentially allowing attackers to read, modify, or delete data and disrupt cluster operations. The vulnerability affects confidentiality, integrity, and availability of the system.

According to the Red Hat advisory, no mitigation that meets Red Hat Product Security criteria is currently available. The advisory states that mitigation options either do not exist or are not practical due to ease of use, deployment, applicability, or stability concerns. Users should monitor Red Hat advisories for updates and consider restricting access to highly privileged roles as a precaution. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.