CVE-2026-71467 Overview
CVE-2026-71467 is an authentication bypass vulnerability in search-v2-api. The authentication middleware unconditionally skips authentication when an incoming request contains an Upgrade: websocket header. An unauthenticated remote attacker can send a crafted HTTP POST request to the /federated endpoint with this header to bypass authentication controls entirely. Successful exploitation returns federated search results from all configured remote managed hubs, exposing sensitive data across the environment. The flaw is tracked under CWE-287: Improper Authentication.
Critical Impact
Unauthenticated attackers can retrieve federated search results across all connected managed hubs by adding a single HTTP header to a request targeting the /federated endpoint.
Affected Products
- search-v2-api component
- Red Hat products bundling the affected search-v2-api (see Red Hat CVE-2026-71467 Advisory)
- Deployments exposing the /federated endpoint to untrusted networks
Discovery Timeline
- 2026-08-11 - CVE CVE-2026-71467 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-71467
Vulnerability Analysis
The vulnerability lives in the request-handling middleware that fronts search-v2-api. The middleware inspects incoming HTTP headers to decide whether authentication should be enforced. When the Upgrade: websocket header is present, the middleware branches into a code path that skips credential validation entirely and forwards the request to the underlying handler. This behavior likely exists to accommodate WebSocket handshakes, which follow a different protocol negotiation flow than standard HTTP requests.
Because the check relies solely on the presence of the header rather than the full WebSocket handshake, attackers can attach the header to any HTTP method. The /federated endpoint accepts POST requests carrying search queries and returns aggregated results from every configured remote managed hub. Combining the bypass with a query to this endpoint yields cross-hub information disclosure without authentication or user interaction.
Root Cause
The root cause is [CWE-287: Improper Authentication]. Authentication logic uses header presence as a proxy for protocol intent, without validating the remainder of the WebSocket handshake (such as Connection: Upgrade, Sec-WebSocket-Key, or the request method). The middleware treats the branch as trusted and forwards the request to sensitive handlers, including federated search.
Attack Vector
The attack is network-based, requires no privileges, and needs no user interaction. An attacker sends an HTTP POST to /federated with an Upgrade: websocket header and a JSON body containing a federated search query. The middleware skips authentication, the handler executes the search across all remote managed hubs, and the response is returned to the attacker. See the Red Hat CVE-2026-71467 Advisory and Red Hat Bugzilla #2512146 for further technical detail.
Detection Methods for CVE-2026-71467
Indicators of Compromise
- HTTP POST requests to /federated that include an Upgrade: websocket header without a corresponding valid WebSocket handshake (missing Sec-WebSocket-Key, Sec-WebSocket-Version, or Connection: Upgrade).
- Requests to /federated originating from unauthenticated sessions or unexpected source IP ranges.
- Unusually large or broad federated search responses returned to clients with no prior authentication events.
Detection Strategies
- Alert on any request to /federated where the Upgrade header is present but the method is not GET or the handshake headers are absent.
- Correlate ingress logs to search-v2-api with authentication logs; flag /federated responses that lack a preceding successful auth event.
- Baseline normal federated search volume per identity and alert on anonymous or unattributed spikes.
Monitoring Recommendations
- Ingest reverse proxy, ingress controller, and search-v2-api logs into a central analytics platform for header-level inspection.
- Enable full request logging on the /federated route, including selected request headers and response sizes.
- Monitor egress from remote managed hubs for unusual query load originating from the federated search aggregator.
How to Mitigate CVE-2026-71467
Immediate Actions Required
- Apply the vendor patch referenced in the Red Hat CVE-2026-71467 Advisory as soon as it is available for your distribution.
- Restrict network exposure of search-v2-api and the /federated endpoint to trusted management networks only.
- Audit access logs for prior requests to /federated containing an Upgrade: websocket header and investigate any matches.
Patch Information
Refer to the Red Hat CVE-2026-71467 Advisory and Red Hat Bugzilla #2512146 for fixed package versions and update instructions. The fix corrects the middleware so that authentication is enforced regardless of the Upgrade header value, and validates the full WebSocket handshake before permitting protocol upgrade.
Workarounds
- Configure an upstream reverse proxy or web application firewall to strip or block Upgrade: websocket headers on POST requests to /federated.
- Enforce authentication at the ingress layer so that unauthenticated requests never reach search-v2-api, regardless of header content.
- Temporarily disable the /federated endpoint if federated search is not required in your deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
