CVE-2026-76827: Protection Mechanism Failure in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

The vulnerability CVE-2026-76827 in Red Hat Advanced Cluster Management for Kubernetes 2.11 involves a protection mechanism failure in the search-indexer component. Authenticated managed clusters can exploit this flaw by crafting user identifiers with a different cluster's prefix, enabling them to tamper with or delete indexed search data belonging to other clusters. This occurs because the delta-sync write paths do not enforce ownership restrictions on UPDATE and DELETE operations, violating data isolation between clusters.

An attacker with authenticated access as a managed cluster can modify or delete indexed search data of other clusters, potentially disrupting cluster management visibility and operations. The vulnerability does not impact confidentiality or availability but has a significant impact on data integrity within the cluster management environment.

Red Hat has issued security advisories and updated container images for Red Hat Advanced Cluster Management for Kubernetes, including versions 2.11.11 and 2.17.1, which address this and other vulnerabilities. Users should apply the relevant security updates as per Red Hat's guidance. Before applying updates, ensure all previously released errata relevant to the system are applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No indication of temporary workarounds or no-action-required statements were found; applying the official patch is recommended.