CVE-2026-71470

In ACM search-v2-operator, CR editor fields (imageOverride, arguments, env vars) are unsanitized into pods running under an impersonation ServiceAccount, enabling arbitrary secret mounting or container image replacement for privilege escalation and full cluster compromise. Red Hat advises restric...