The vulnerability exists in the search-indexer component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The delta-sync write paths do not properly restrict UPDATE and DELETE operations to data owned by the calling cluster, enabling a registered and authenticated managed cluster to manipulate or delete indexed search data belonging to other clusters. Exploitation requires possession of legitimate managed-cluster credentials and involves crafting user identifiers with a different cluster's prefix to bypass protections. This is classified as a protection mechanism failure (CWE-693).

An attacker with legitimate managed-cluster credentials can tamper with or delete indexed search data of other clusters, impacting data integrity. There is no impact on confidentiality or availability. The vulnerability is limited by the requirement for high privileges (authenticated managed-cluster access).

Currently, there is no available mitigation or fix that meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates. Since exploitation requires authenticated managed-cluster credentials, controlling and limiting cluster access is a recommended defensive measure until a fix is released.