CVE-2026-71473
Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke
- State
- Published
- Severity
- 8.5 High
- Published
- Aug 12, 2026
- Updated
- Sep 5, 2026
- Reserved
- Aug 6, 2026
Description
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N | redhat |
Weaknesses
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected Products
| Product | Versions |
|---|---|
Red Hat Advanced Cluster Management for Kubernetes 2.11Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.13Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.14Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.15Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat |
|
References
- RHSA-2026:60386vendor-advisory
- RHSA-2026:60387vendor-advisory
- RHSA-2026:60388vendor-advisory
- RHSA-2026:60389vendor-advisory
- RHSA-2026:60390vendor-advisory
- RHSA-2026:60391vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-71473vdb-entry
- RHBZ#2512152issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.