9.9

CVE-2026-70496

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.11
Default Statusaffected
Version 1787688827
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.13
Default Statusaffected
Version 1787682112
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.14
Default Statusaffected
Version 1787682033
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.15
Default Statusaffected
Version 1787681674
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.16
Default Statusaffected
Version 1787681686
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.17
Default Statusaffected
Version 1787681651
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2.17
Default Statusaffected
Version 1787229539
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Advanced Cluster Management for Kubernetes 2
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.177
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

https://access.redhat.com/security/cve/CVE-2026-70496
https://bugzilla.redhat.com/show_bug.cgi?id=2511032
https://access.redhat.com/errata/RHSA-2026:60386
https://access.redhat.com/errata/RHSA-2026:60389
https://access.redhat.com/errata/RHSA-2026:60390
https://access.redhat.com/errata/RHSA-2026:60387
https://access.redhat.com/errata/RHSA-2026:60388
https://access.redhat.com/errata/RHSA-2026:60391