This vulnerability affects the search-v2-api component of Red Hat Advanced Cluster Management for Kubernetes. It allows an unauthenticated attacker to exploit an unbounded cache by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the tokenReviews cache, which is not properly cleared, leading to memory exhaustion of the search-api pod. This results in a denial of service (DoS) condition. The flaw is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). The component is exposed to unauthenticated requests, increasing the risk of exploitation. No official fix or patch is currently confirmed by Red Hat, but network-level mitigations are recommended.

The impact is a denial of service caused by memory exhaustion of the search-api pod in Red Hat Advanced Cluster Management for Kubernetes. This results in service unavailability. There is no confidentiality or integrity impact. The vulnerability can be exploited remotely without authentication or user interaction, making it a high-severity availability risk.

Red Hat advises restricting network access to the search-v2-api component by implementing network policies that limit incoming connections to trusted sources only. This reduces the attack surface for unauthenticated denial-of-service attempts. After applying network policies, the search-v2-api pod should be restarted to ensure the new rules take effect. No official patch or update is currently available; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.