CVE-2026-70495
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.
Risk Assessment
The risk is critical because compromising the service account could lead to full cluster compromise, including access to all resources and data. However, it requires prior access to a pod.
Recommendation
It is recommended to immediately restrict the permissions of the `search-serviceaccount` following the principle of least privilege. Also, monitor access to pods and audit permissions.
Other vulnerabilities in search-v2-operator
See all- CVE-2026-70496Critical
A flaw was found in search-v2-operator: its ClusterRole has permissions equivalent to a cluster administrator, allowing impersonation, RBAC modification, CSR approval, and ManifestWork management, leading to excessive privileges and potential privilege escalation.
- CVE-2026-71470Critical
A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one, leading to privilege escalation and potential full cluster compromise.
- CVE-2026-71473High
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Original NVD description (English source)
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS