Arbitrary Configuration Injection Vulnerability in Red Hat Managed Clusters
CVE-2026-71473

8.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Management For Kubernetes 2
Vendor
CVE Published:
12 August 2026

What is CVE-2026-71473?

A flaw in the 'search-v2-operator' component allows a user with specific administrative permissions on a managed cluster to execute an arbitrary configuration data injection. This vulnerability can lead to the manipulation of critical settings, enabling the replacement of container images within the managed cluster. Such actions may compromise the integrity and security of the entire cluster, highlighting the importance of implementing robust security measures and stringent access controls.

References

https://access.redhat.com/security/cve/CVE-2026-71473
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2512152
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.