Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-71472

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

Default version status: affected

  • 1787688827 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13

Default version status: affected

  • 1787682112 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14

Default version status: affected

  • 1787682033 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

Default version status: affected

  • 1787681674 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Default version status: affected

  • 1787681686 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Default version status: affected

  • 1787681651 to < *unaffected

References