CVE-2026-71472

The flaw resides in postgresql-start.sh within the search-v2-operator of acm-search-v2-rhel9. The WORK_MEM string supplied via a Search Custom Resource is passed unvalidated into both a bash script and an SQL query, enabling authenticated hub administrators or CR editors to inject shell commands ...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

EUVD-2026-60362

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

PT-2026-76763

Name of the Vulnerable Software and Affected Versions acm-search-v2-rhel9 affected versions not specified Description An authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, can inject malicious shell commands or SQL statements. This issue exists because the...

EUVD-2026-57686

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71471

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

CVE-2026-71471

The CVE-2026-71471 issue affects acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster who has patch access to the Search Custom Resource can exploit the Collector.ImageOverride field to deploy an arbitrary container image across all managed clusters, enabling remote ...

CVE-2026-71469

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-ap...

CVE-2026-71471

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource CR, could exploit a vulnerability in the Collector.ImageOverride field. This allows the attacker to deploy an arbitrary container...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.5 security update

Red Hat Advanced Cluster Management for Kubernetes v2.15 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

CVE-2026-70398

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

CVE-2026-73122

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

CVE-2026-73122 Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

EUVD-2026-57060

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

CVE-2026-70398

CVE-2026-70398 — Normal mode Affected product/area: Red Hat Advanced Cluster Management (RHACM) with the multicloud-integrations component. The issue lies in the GitOpsCluster controller, where an authenticated tenant can manipulate the argoserver/argosamespace logic to write or redirect spoke cl...