Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-70496

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

Default version status: affected

  • 1787688827 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13

Default version status: affected

  • 1787682112 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14

Default version status: affected

  • 1787682033 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

Default version status: affected

  • 1787681674 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Default version status: affected

  • 1787681686 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Default version status: affected

  • 1787681651 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Default version status: affected

  • 1787229539 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Default version status: unaffected

References