The vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.17 affects the search-v2-api authentication middleware, which unconditionally bypasses authentication when the 'Upgrade: websocket' header is present in a request. This allows unauthenticated attackers to send specially crafted HTTP POST requests to the /federated endpoint and retrieve federated search results from all configured remote managed hubs, leading to unauthorized information disclosure. The FEATURE_FEDERATED_SEARCH feature must be enabled for this vulnerability to be exploitable; it is enabled by default in Global Hub deployments but disabled by default in standard deployments. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. Red Hat advises disabling the FEATURE_FEDERATED_SEARCH if not in use or restricting network access to trusted clients for the affected endpoint.

An unauthenticated attacker can bypass authentication by spoofing the WebSocket upgrade header and access federated search results across all remote managed hubs configured in the environment. This leads to unauthorized disclosure of potentially sensitive information. There is no impact on integrity or availability. The vulnerability is significant in deployments where FEATURE_FEDERATED_SEARCH is enabled, especially Global Hub deployments where it is enabled by default.

Red Hat recommends disabling the FEATURE_FEDERATED_SEARCH feature if it is not actively used, as it is off by default in standard deployments. For Global Hub deployments where this feature is enabled by default, it is advised to restrict network access to the search-v2-api's /federated endpoint to trusted clients only. No official patch or fix version is explicitly stated in the advisory, so patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.