Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-70495

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

Default version status: affected

  • 1787688827 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13

Default version status: affected

  • 1787682112 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14

Default version status: affected

  • 1787682033 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

Default version status: affected

  • 1787681674 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Default version status: affected

  • 1787681686 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Default version status: affected

  • 1787681651 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Default version status: affected

References