CVE-2026-71469 is a denial-of-service vulnerability in the search-v2-api component of Red Hat Advanced Cluster Management for Kubernetes. The flaw arises because each unique bearer token sent by an unauthenticated attacker creates a permanent entry in an unbounded tokenReviews cache that is not properly cleared. This leads to memory exhaustion of the search-api pod, causing service unavailability. The vulnerability is due to allocation of resources without limits or throttling (CWE-770). The attack vector is network-based with low complexity and no privileges or user interaction required. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity.

An unauthenticated attacker can cause a denial of service by exhausting memory resources of the search-api pod through unbounded growth of the tokenReviews cache. This results in service unavailability of the search-v2-api component. There is no impact on confidentiality or integrity. The vulnerability affects availability only.

No official patch or fix is currently available for this vulnerability. The vendor advises mitigating the risk by restricting network access to the search-v2-api component via network policies that limit incoming connections to trusted sources only. After applying these network policies, the search-v2-api pod should be restarted to enforce the new rules. This mitigation reduces the attack surface and prevents unauthenticated denial-of-service attempts.