CVE-2026-71470: Improper Control of Dynamically-Managed Code Resources in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Description
CVE-2026-71470 is a critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.11 affecting the search-v2-operator. It allows a privileged user with Custom Resource editor permissions to manipulate certain fields without proper validation, enabling them to inject arbitrary secrets or replace container images. This can lead to privilege escalation and potentially full cluster compromise due to the extensive impersonation permissions of the ServiceAccount involved. The vulnerability has a CVSS score of 9.1, indicating high severity. Red Hat has released security updates addressing this issue in later versions, notably in the 2.17 release series.
CVSS v3.1
Score 9.1critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the search-v2-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.11 allows a privileged user (Custom Resource editor) to improperly control dynamically-managed code resources. Specifically, the attacker can manipulate Search Custom Resource fields such as imageOverride, arguments, and environment variables without validation. This flaw permits mounting arbitrary secrets into the search container's environment or substituting the container image with a malicious one. Due to the ServiceAccount's broad impersonation permissions, exploitation can escalate privileges and lead to full cluster compromise. Red Hat has rated this vulnerability as critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Security advisories indicate that updated container images and security fixes are available in newer releases, particularly version 2.17.1 and later.
Potential Impact
Exploitation of this vulnerability allows a privileged user with Custom Resource editing rights to escalate privileges by injecting arbitrary secrets or replacing container images in the search container. This can lead to full cluster compromise due to the extensive permissions of the associated ServiceAccount. The impact includes complete confidentiality, integrity, and availability loss within the Kubernetes cluster managed by Red Hat Advanced Cluster Management.
Mitigation Recommendations
Red Hat has released security updates addressing this vulnerability in Red Hat Advanced Cluster Management for Kubernetes version 2.17.1 and later. Users should apply these updates to remediate the issue. Before applying the update, ensure all previously released relevant errata are applied. Refer to Red Hat's official guidance on applying updates at https://access.redhat.com/articles/11258. No indication exists that the vulnerability is mitigated without applying these updates; therefore, patching is the recommended course of action.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5g3m-2273-p6x6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-71470"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Patch Information
Threat ID: 6a905402acd9273b49697076
Added to database: 08/27/2026, 15:13:06 UTC
Last enriched: 09/08/2026, 15:07:43 UTC
Last updated: 10/10/2026, 06:48:18 UTC
Views: 44
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.