CVE-2026-70496
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A flaw was found in search-v2-operator: its ClusterRole has permissions equivalent to a cluster administrator, allowing impersonation, RBAC modification, CSR approval, and ManifestWork management, leading to excessive privileges and potential privilege escalation.
Risk Assessment
Excessive operator privileges may allow an attacker to escalate privileges within the cluster, potentially leading to full cluster compromise.
Recommendation
Restrict the operator's ClusterRole to the minimum required permissions and apply vendor-provided fixes.
Other vulnerabilities in search-v2-operator
See all- CVE-2026-71470Critical
A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one, leading to privilege escalation and potential full cluster compromise.
- CVE-2026-70495High
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.
- CVE-2026-71473High
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Original NVD description (English source)
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS