CVE-2026-71473
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Risk Assessment
The risk includes compromise of the managed cluster's integrity through injection of malicious container images, which can lead to unauthorized access and takeover of the cluster.
Recommendation
It is recommended to restrict administrative permissions and monitor configuration changes, as well as apply patches provided by the software vendor.
Other vulnerabilities in search-v2-operator
See all- CVE-2026-70496Critical
A flaw was found in search-v2-operator: its ClusterRole has permissions equivalent to a cluster administrator, allowing impersonation, RBAC modification, CSR approval, and ManifestWork management, leading to excessive privileges and potential privilege escalation.
- CVE-2026-71470Critical
A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one, leading to privilege escalation and potential full cluster compromise.
- CVE-2026-70495High
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.
Original NVD description (English source)
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS