CVE-2026-71469
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).
Risk Assessment
The risk is the potential memory exhaustion of the search-api pod by an unauthenticated attacker, leading to denial of service (DoS).
Recommendation
It is recommended to implement limits on the tokenReviews cache and regularly clear entries, as well as apply patches provided by the software vendor.
Other vulnerabilities in search-v2-api
Original NVD description (English source)
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS