Excessive Permissions in search-v2-operator Affects Red Hat Products
CVE-2026-70495

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Management For Kubernetes 2
Vendor
CVE Published:
17 August 2026

What is CVE-2026-70495?

A significant vulnerability exists in the search-v2-operator component due to excessively permissive roles assigned to the search-serviceaccount. This configuration permits the service account to impersonate any user or group within the entire cluster. Consequently, if an attacker compromises any pod running under this service account, they could leverage these privileges to gain system:masters access, thus enabling full control over the cluster. This flaw underscores the importance of least privilege principles in managing access control in Kubernetes environments.

References

https://access.redhat.com/security/cve/CVE-2026-70495
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511031
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.