Skip to content
fr Sign in
5.3 Medium

CVE-2026-71468 A flaw was found in acm-search-v2-api-rhel9

Description

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787689524 earliest → < 1787689524 1787689524
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263804 earliest → < 1787263804 1787263804
Red Hat Advanced Cluster Management for Kubernetes 2.14 1786723845 earliest → < 1786723845 1786723845
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238618 earliest → < 1787238618 1787238618
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787191668 earliest → < 1787191668 1787191668
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787229541 earliest → < 1787229541 1787229541
Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1786723845 earliest → < 1786723845 1786723845

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE