Skip to content
fr Sign in
6.8 Medium

CVE-2026-76827 A flaw was found in search-indexer

Description

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787688957 earliest → < 1787688957 1787688957
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787262474 earliest → < 1787262474 1787262474
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787250074 earliest → < 1787250074 1787250074
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787249293 earliest → < 1787249293 1787249293
Red Hat Advanced Cluster Management for Kubernetes 2.16 1787248491 earliest → < 1787248491 1787248491
Red Hat Advanced Cluster Management for Kubernetes 2.17 1787247085 earliest → < 1787247085 1787247085
Red Hat Advanced Cluster Management for Kubernetes 2.14.0 1787250074 earliest → < 1787250074 1787250074

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2.11

The 49 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2.11 →
CVE-2026-73137 A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) 7.7 High CVE-2026-67567 A flaw was found in the multicloud-operators-subscription component 9.9 Critical CVE-2026-76139 A flaw was found in acm-operator-bundle 8.0 High CVE-2026-70496 A flaw was found in search-v2-operator 9.9 Critical
Track this CVE