CVE-2026-71467: search-v2-api · Improper Authentication
Source GCVE Database
Not known to be exploited · CVSS 7.5 High : patch Red Hat Advanced Cluster Management for Kubernetes 2.17 soon.
Data as of 9 Nov 2026, 23:24 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 11 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
What to do
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Red HatRed Hat Advanced Cluster Management for Kubernetes 2.17 | Affected– | Fixed in– |
AI-suggested
A security update is available from Red Hat as detailed in advisory RHSA-2026:60386. Users of Red Hat Advanced Cluster Management for Kubernetes should apply the update to remediate this vulnerability. The vendor advisory provides instructions for applying the update and recommends ensuring all previously released errata are applied before this update. No alternative mitigations or workarounds are specified.
Description
A vulnerability in the search-v2-api component allows authentication bypass when a request includes an 'Upgrade: websocket' header. An unauthenticated attacker can send a crafted HTTP POST request to the /federated endpoint with this header to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.