The vulnerability CVE-2026-71467 affects the search-v2-api authentication middleware in Red Hat Advanced Cluster Management for Kubernetes. When a request includes an 'Upgrade: websocket' header, the middleware unconditionally skips authentication, allowing an unauthenticated attacker to send a specially crafted HTTP POST request to the /federated endpoint. This bypasses authentication controls and grants access to federated search results from all configured remote managed hubs, resulting in information disclosure. The FEATURE_FEDERATED_SEARCH feature, which enables this endpoint, is enabled by default in Global Hub deployments but disabled by default in standard deployments. The vulnerability is tracked under CWE-287 (Improper Authentication) and has a CVSS v3.1 score of 7.5 (high severity).

An unauthenticated attacker can bypass authentication by spoofing the WebSocket upgrade header and access sensitive federated search results across all configured remote managed hubs. This leads to unauthorized information disclosure but does not impact integrity or availability. The vulnerability affects deployments where FEATURE_FEDERATED_SEARCH is enabled, notably Global Hub deployments of Red Hat Advanced Cluster Management for Kubernetes.

Red Hat advises disabling the FEATURE_FEDERATED_SEARCH feature if it is not actively used, as it is off by default in standard deployments. For Global Hub deployments where this feature is enabled by default, it is recommended to restrict network access to the search-v2-api's /federated endpoint to trusted clients. No official patch or update is currently available; patch status is not yet confirmed—check the vendor advisory for updates.