A flaw in the acm-search-v2-api-rhel9 component of Red Hat Advanced Cluster Management for Kubernetes 2 causes the getFederationConfig function to improperly reuse a user's bearer token for all subsequent federated requests until the cache expires. This token reuse allows other authenticated users to gain unauthorized access to remote managed hub search results, resulting in information disclosure. Exploitation requires the FEATURE_FEDERATED_SEARCH feature to be enabled, which is disabled by default. The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment).

The vulnerability allows authenticated users to access search results from remote managed hubs that they should not be authorized to see, causing information disclosure. There is no impact on integrity or availability. The attack complexity is high, and privileges required are low. User interaction is not required.

Red Hat advises ensuring that the FEATURE_FEDERATED_SEARCH is not enabled if federated search functionality is not required, as it is disabled by default. If this feature is enabled, consider disabling it to prevent unauthorized cross-user data access. Disabling this feature will impact the ability to perform federated searches across managed hubs. No official patch or fix status is currently provided; check the vendor advisory for updates.