This vulnerability (CVE-2026-71473) affects the search-v2-operator component in Red Hat Advanced Cluster Management for Kubernetes. An attacker with patch managedclusteraddons permission can exploit the flaw by manipulating the addon.open-cluster-management.io/values annotation on a ManagedClusterAddOn resource. This enables arbitrary override of Helm values, resulting in container image injection and privilege escalation on the managed cluster. The flaw is categorized under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The CVSS 3.1 base score is 8.5 (high), with network attack vector, low complexity, low privileges required, no user interaction, and scope changed. Confidentiality impact is high, integrity impact is low, and availability impact is none. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, or stability.

An attacker with specific administrative permissions can inject arbitrary container images into the managed cluster by overriding critical configuration settings. This leads to container image injection, privilege escalation, and arbitrary code execution on the managed cluster, potentially compromising its integrity and confidentiality. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Currently, Red Hat has not released an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is available, restricting administrative permissions on managed clusters and monitoring for unauthorized configuration changes may reduce risk, but no direct mitigation is provided by Red Hat.