CVE-2026-70496: Execution with Unnecessary Privileges in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Description
CVE-2026-70496 is a critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.11 affecting the search-v2-operator. The operator's ClusterRole is assigned excessive privileges equivalent to a cluster administrator, enabling it to impersonate other entities, modify RBAC configurations, approve CSRs, and manage ManifestWork. This over-privileging can lead to privilege escalation within the Kubernetes cluster. Red Hat has issued security advisories recommending updates to later versions that address this and other vulnerabilities. No known exploits are reported in the wild at this time.
CVSS v3.1
Score 9.9critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-70496 involves the search-v2-operator in Red Hat Advanced Cluster Management for Kubernetes 2.11 having a ClusterRole with cluster administrator-level permissions. This grants the operator unnecessary privileges, including the ability to impersonate other entities, write RBAC configurations, approve Certificate Signing Requests, and manage ManifestWork resources. Such excessive privileges violate the principle of least privilege and could allow an attacker to escalate privileges within the cluster. The CVSS v3.1 score is 9.9 (critical), reflecting the high impact on confidentiality, integrity, and availability. Red Hat has released updated container images and advisories for newer versions (e.g., 2.17.1) that include security fixes, but no direct fix is indicated for version 2.11.11 in the advisory. Users are advised to apply updates to the latest versions where fixes are included.
Potential Impact
The vulnerability allows the search-v2-operator to perform actions with cluster administrator privileges, which can lead to privilege escalation within the Kubernetes cluster. This can compromise cluster security by enabling unauthorized impersonation, modification of RBAC policies, approval of CSRs, and management of critical cluster resources. The impact affects confidentiality, integrity, and availability of the cluster environment.
Mitigation Recommendations
Red Hat has issued security advisories recommending updating to newer versions of Red Hat Advanced Cluster Management for Kubernetes, such as v2.17.1, which include security fixes addressing this and other vulnerabilities. Users should ensure all relevant errata and updates are applied according to Red Hat's guidance. For version 2.11.11, no direct fix is indicated in the advisory; therefore, upgrading to a fixed version is the recommended mitigation. Patch status for 2.11.11 is not explicitly confirmed as fixed; users should consult the vendor advisory for the latest remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xg68-vc28-3f79
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70496"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6a905402acd9273b4969706b
Added to database: 08/27/2026, 15:13:06 UTC
Last enriched: 09/08/2026, 15:22:13 UTC
Last updated: 10/11/2026, 06:48:18 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.