The vulnerability in the search-v2-operator of Red Hat Advanced Cluster Management for Kubernetes 2.11 permits a privileged user (Custom Resource editor) to modify Search CR fields such as imageOverride, arguments, and environment variables without proper validation. This flaw enables the attacker to inject arbitrary container images or mount arbitrary secrets into pods, leveraging the ServiceAccount's cluster-wide impersonation capabilities to escalate privileges and potentially compromise the entire Kubernetes cluster. The vulnerability has a CVSS v3.1 score of 9.1, indicating critical severity. Exploitation requires high privileges (CR edit permissions), limiting the attack vector to already privileged users. The vendor advisory recommends restricting permissions for creating and modifying Search CRs to trusted users and implementing Kubernetes RBAC policies to limit create, update, and patch operations on the affected resources.

A privileged user with Custom Resource edit permissions can exploit this vulnerability to escalate privileges by injecting arbitrary container images or mounting sensitive secrets into pods. This can lead to a full cluster compromise due to the ServiceAccount's extensive impersonation permissions. The impact includes complete confidentiality, integrity, and availability loss within the Kubernetes cluster managed by Red Hat Advanced Cluster Management.

Red Hat advises restricting permissions for creating and modifying Search Custom Resources to only trusted and authorized users. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit who can perform create, update, and patch operations on search.search.open-cluster-management.io resources. This reduces the attack surface by preventing unauthorized users from exploiting the unsanitized input flow. No official patch for version 2.11 is explicitly stated in the advisory; however, Red Hat has released security updates in later versions (e.g., 2.17.1) that include security fixes. Users should upgrade to a supported version that includes these fixes or apply the recommended RBAC mitigations.