The vulnerability CVE-2026-70495 affects the search-v2-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The search-serviceaccount is granted excessive permissions that enable cluster-wide impersonation of users and groups. If an attacker compromises any pod running under this service account, they can escalate privileges to system:masters, effectively gaining full administrative control over the Kubernetes cluster. The CVSS v3.1 base score is 8.8 (high), reflecting local attack vector, low complexity, low privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. Red Hat has acknowledged the severity but currently does not have an official fix or mitigation that meets their criteria for ease of use and deployment. The issue is tracked under Bugzilla 2511031 and classified as CWE-269 (Improper Privilege Management).

Successful exploitation allows an attacker with access to any pod running under the search-serviceaccount to impersonate any user or group across the entire Kubernetes cluster, escalating privileges to system:masters. This grants full administrative control over the cluster, compromising confidentiality, integrity, and availability of the environment. The vulnerability poses a severe risk to the integrity and control of Red Hat Advanced Cluster Management for Kubernetes deployments.

Currently, Red Hat has not provided an official fix or mitigation for this vulnerability that meets their criteria for ease of use, deployment, and stability. Users should monitor Red Hat advisories for updates and consider restricting access to pods running under the search-serviceaccount as a temporary measure. Engaging with Red Hat Technical Account Managers (TAM) may provide additional guidance. No direct patch or workaround is available at this time.