CVE-2026-71472 is a critical vulnerability in acm-search-v2-rhel9 where the WORK_MEM string provided in the Search Custom Resource is not properly validated before use in a bash script and an SQL query. This improper input handling leads to shell command and SQL injection vulnerabilities, allowing an authenticated user with high privileges to execute arbitrary commands within the privileged postgres pod. This results in a complete compromise of the cluster's search service with cluster-wide impersonate privileges. The vulnerability is classified under CWE-78 (OS Command Injection) and has a CVSS v3.1 base score of 9.1, indicating critical severity. Red Hat has not released a patch or mitigation that meets their criteria for ease of use, applicability, or stability.

Successful exploitation allows a highly privileged authenticated user to execute arbitrary shell commands or SQL statements in the privileged postgres pod. This can lead to full system compromise of the cluster's search service, including cluster-wide impersonation privileges, potentially affecting confidentiality, integrity, and availability of the system. The vulnerability impacts the Red Hat Advanced Cluster Management for Kubernetes environment and can result in unauthorized code execution and system control.

Currently, there is no available mitigation or patch that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is released, restricting access to highly privileged roles such as hub administrators and Search CR editors is recommended to reduce risk. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for guidance.