CVE-2026-70495: search-v2-operator Privilege Escalation

CVE-2026-70495 Overview

CVE-2026-70495 is a privilege escalation vulnerability in the search-v2-operator component. The search-serviceaccount associated with this operator holds cluster-wide impersonation permissions on users and groups. An attacker who compromises any pod running under this service account can leverage these permissions to impersonate system:masters, the built-in Kubernetes group that grants full administrative control over the cluster. The flaw is categorized under CWE-269: Improper Privilege Management.

Critical Impact
Compromise of any pod under search-serviceaccount results in full cluster takeover through impersonation of system:masters.

Affected Products

search-v2-operator component
Kubernetes clusters running the affected operator with search-serviceaccount deployed
Red Hat Advanced Cluster Management deployments including the search component (see Red Hat CVE-2026-70495 Advisory)

Discovery Timeline

2026-08-17 - CVE-2026-70495 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-70495

Vulnerability Analysis

The vulnerability stems from an overly permissive Role-Based Access Control (RBAC) configuration bound to the search-serviceaccount. This service account is granted the impersonate verb on the users and groups resources across the entire cluster scope. In Kubernetes, the impersonate verb allows an authenticated principal to act as any other user or group when making API requests.

Because the impersonation permission is not restricted by resourceNames, the service account can impersonate any principal, including members of the system:masters group. Requests made under system:masters bypass RBAC evaluation entirely and are treated as super-user calls by the API server.

An attacker who obtains the service account token from a pod, through container escape, code execution, or a sidecar compromise, can issue API requests with Impersonate-User and Impersonate-Group headers set to system:masters. The result is unrestricted control of the cluster, including secret exfiltration, workload manipulation, and persistence.

Root Cause

The root cause is an improperly scoped ClusterRole bound to search-serviceaccount. The role grants impersonate privileges on users and groups without narrowing the allowed target identities via resourceNames. This violates least-privilege principles for Kubernetes service accounts.

Attack Vector

Exploitation requires local access to a pod running under the search-serviceaccount. The attacker reads the mounted service account token from /var/run/secrets/kubernetes.io/serviceaccount/token and issues an authenticated API request to kube-apiserver with impersonation headers targeting system:masters. No user interaction is required, and the attack completes within a single API call. See the Red Hat Bug Report #2511031 for additional technical context.

Detection Methods for CVE-2026-70495

Indicators of Compromise

Kubernetes API audit log entries showing Impersonate-User or Impersonate-Group headers originating from search-serviceaccount
API requests authenticated as system:masters where the underlying service account is system:serviceaccount:<namespace>:search-serviceaccount
Unexpected creation of ClusterRoleBinding objects granting cluster-admin privileges from a search-related pod
Secret enumeration or cross-namespace reads originating from the search operator namespace

Detection Strategies

Enable Kubernetes API server audit logging at the Metadata level or higher and alert on any request containing impersonation headers
Query audit logs for user.username="system:serviceaccount:*:search-serviceaccount" combined with impersonatedUser.groups containing system:masters
Inspect current cluster RBAC to identify any ClusterRole granting impersonate on users, groups, or serviceaccounts without resourceNames constraints

Monitoring Recommendations

Forward Kubernetes audit logs to a centralized analytics platform and build detections for anomalous impersonation activity
Monitor pod egress from the search operator namespace for API calls to kube-apiserver that exceed the operator's documented behavior
Track service account token usage and alert on tokens accessed by processes other than the operator's primary container

How to Mitigate CVE-2026-70495

Immediate Actions Required

Apply the patched release of search-v2-operator referenced in the Red Hat CVE-2026-70495 Advisory as soon as it is available for your distribution
Audit the ClusterRole and ClusterRoleBinding objects associated with search-serviceaccount and remove any unbounded impersonate verb grants
Rotate the search-serviceaccount token and any credentials that may have been accessible from affected pods
Restrict network egress from the search operator pods to only the required Kubernetes API endpoints

Patch Information

Red Hat has published tracking and remediation guidance under Red Hat CVE-2026-70495 Advisory and Red Hat Bug Report #2511031. Administrators should upgrade the operator to the fixed version identified in these references and verify that the updated RBAC manifests scope impersonation permissions to only the specific principals required.

Workarounds

Temporarily remove the impersonate verb from the ClusterRole bound to search-serviceaccount if the operator's functionality permits
Constrain impersonation by adding explicit resourceNames entries that exclude system:masters and other privileged groups
Apply a Kubernetes admission policy, such as a ValidatingAdmissionPolicy or OPA Gatekeeper constraint, that denies requests impersonating system:masters or cluster-admin from operator service accounts
Isolate the search operator into a dedicated node pool with restricted workload scheduling to reduce lateral movement opportunities

bash

# Inspect impersonation permissions bound to the service account
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.subjects[]?.name=="search-serviceaccount") | .roleRef.name'

# Review the associated ClusterRole for impersonate verbs
kubectl get clusterrole <role-name> -o yaml | grep -A2 impersonate