The vulnerability exists in the search-v2-api component of Red Hat Advanced Cluster Management for Kubernetes 2, where the authentication middleware unconditionally skips authentication if the request contains an 'Upgrade: websocket' header. An attacker can exploit this by sending a specially crafted HTTP POST request to the /federated endpoint with this header, bypassing authentication and gaining unauthorized access to federated search results across all remote managed hubs. This flaw is tied to the FEATURE_FEDERATED_SEARCH feature, which is enabled by default in Global Hub deployments but off by default in standard deployments. The vulnerability leads to information disclosure but does not affect integrity or availability. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. The vendor advisory recommends disabling FEATURE_FEDERATED_SEARCH if not in use or restricting network access to the /federated endpoint. No official patch or remediation level is currently stated in the advisory.

An unauthenticated attacker can bypass authentication by spoofing the WebSocket upgrade header, allowing unauthorized access to federated search results across all configured remote managed hubs. This leads to unauthorized information disclosure of potentially sensitive data. There is no impact on integrity or availability. The vulnerability affects deployments where FEATURE_FEDERATED_SEARCH is enabled, which is the default for Global Hub deployments.

Red Hat advises disabling the FEATURE_FEDERATED_SEARCH feature if it is not actively used, as it is off by default in standard deployments. For Global Hub deployments where this feature is enabled by default, it is recommended to restrict network access to the search-v2-api's /federated endpoint to trusted clients. No official patch or fix has been announced yet; therefore, these mitigations are the primary means to reduce risk until a fix is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.