7.5 High

CVE-2026-71469 A flaw was found in search-v2-api

Description

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2	Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787689524	earliest → < 1787689524	1787689524
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263804	earliest → < 1787263804	1787263804
Red Hat Advanced Cluster Management for Kubernetes 2.14 1786723845	earliest → < 1786723845	1786723845
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238618	earliest → < 1787238618	1787238618
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787191668	earliest → < 1787191668	1787191668
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787229541	earliest → < 1787229541	1787229541

References

RHSA-2026:60386 access.redhat.com
RHSA-2026:60387 access.redhat.com
RHSA-2026:60388 access.redhat.com
RHSA-2026:60389 access.redhat.com
RHSA-2026:60390 access.redhat.com
RHSA-2026:60391 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2512148 bugzilla.redhat.com

Timeline

Published August 12, 2026
Last modified September 5, 2026

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →

CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium

Track this CVE