8.8

CVE-2026-70495

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.11
Default Statusaffected
Version 1787688827
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.13
Default Statusaffected
Version 1787682112
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.14
Default Statusaffected
Version 1787682033
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.15
Default Statusaffected
Version 1787681674
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.16
Default Statusaffected
Version 1787681686
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.17
Default Statusaffected
Version 1787681651
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.01
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.8 2 6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://access.redhat.com/security/cve/CVE-2026-70495
https://bugzilla.redhat.com/show_bug.cgi?id=2511031
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60387
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60391