CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

PT-2026-76763

Name of the Vulnerable Software and Affected Versions acm-search-v2-rhel9 affected versions not specified Description An authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, can inject malicious shell commands or SQL statements. This issue exists because the...

EUVD-2026-57686

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71469 Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-ap...

CVE-2026-71471

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71471

The CVE-2026-71471 issue affects acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster who has patch access to the Search Custom Resource can exploit the Collector.ImageOverride field to deploy an arbitrary container image across all managed clusters, enabling remote ...

CVE-2026-71471

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

PT-2026-71359

Name of the Vulnerable Software and Affected Versions acm-search-v2-rhel9 affected versions not specified Description An attacker with administrative privileges on the hub cluster, specifically those with patch access to the Search Custom Resource CR, can exploit a flaw in the...

CVE-2026-71471: Inclusion of Functionality from Untrusted Control Sphere

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71468 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

EUVD-2026-56900

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71468

The CVE-2026-71468 entry concerns acm-search-v2-api-rhel9. When getFederationConfig refreshes its cache, it improperly reuses a single user’s bearer token for all subsequent federated requests until cache expiry. This causes information disclosure by allowing other authenticated users to access r...

CVE-2026-71475

The CVE describes a vulnerability in insights-client for RHEL9 where a compromised spoke can inject an unencoded ClusterID into the Insights API URL path. Since the ClusterID is used directly in the request path without validation or URL encoding, authenticated requests can be redirected to unint...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

PT-2026-70868

Name of the Vulnerable Software and Affected Versions acm-search-v2-api-rhel9 affected versions not specified Description A flaw exists where the getFederationConfig function improperly reuses a user's bearer token for all subsequent federated requests during cache refreshes until the cache...

CVE-2026-71468: Incorrect Privilege Assignment

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...