CVE-2026-71468 Overview
CVE-2026-71468 is an information disclosure vulnerability in the acm-search-v2-api-rhel9 component of Red Hat Advanced Cluster Management (ACM). The flaw resides in the getFederationConfig function, which improperly reuses a user's bearer token when refreshing its cache. Subsequent federated search requests from other authenticated users execute under the cached token until it expires. Attackers with valid authentication can retrieve remote managed hub search results belonging to other users, leading to unauthorized information disclosure across managed clusters.
Critical Impact
Authenticated users can access federated search results from remote managed hubs using another user's cached bearer token, exposing cluster metadata and workload information.
Affected Products
- Red Hat Advanced Cluster Management acm-search-v2-api-rhel9
- Federated search deployments across managed hubs
- ACM environments running the affected search API build
Discovery Timeline
- 2026-08-11 - CVE-2026-71468 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-71468
Vulnerability Analysis
The flaw is categorized under [CWE-266: Incorrect Privilege Assignment]. The getFederationConfig function caches configuration used to issue federated search requests to remote managed hubs. During cache refresh, the function stores the bearer token of the requesting user rather than scoping tokens per session. All authenticated users hitting the API before cache expiration inherit that cached token. Federated queries then execute with the privileges of the original token owner. The result is cross-user access to search results the current requester should not see.
Root Cause
The cache layer conflates request-scoped authentication material with globally shared configuration. Bearer tokens are per-user credentials and must not persist beyond the request that supplied them. Storing the token in a shared cache violates least-privilege boundaries between authenticated users of the search API.
Attack Vector
Exploitation requires network access to the ACM search API and low-privileged authenticated access. An attacker submits a federated search request during the cache validity window populated by another user's token. The API returns results authorized under the cached user's identity rather than the attacker's. No user interaction is required, and confidentiality of remote hub data is directly impacted while integrity and availability are unaffected.
See the Red Hat Security Advisory CVE-2026-71468 and Red Hat Bug Report #2512147 for vendor technical details.
Detection Methods for CVE-2026-71468
Indicators of Compromise
- Federated search responses containing resources or namespaces the requesting user has no RBAC entitlement to view.
- Audit log entries showing the same bearer token identity executing federated queries originating from different client sessions or source IPs.
- Unexpected access patterns to managed hub search endpoints correlated with cache refresh intervals.
Detection Strategies
- Correlate ACM API audit logs against Kubernetes RBAC bindings to identify federated result sets that exceed the requester's authorization scope.
- Monitor the acm-search-v2-api-rhel9 process for repeated federated requests answered with token identities inconsistent with the calling user.
- Alert on bearer token reuse across distinct authenticated sessions within short time windows.
Monitoring Recommendations
- Enable verbose audit logging on the ACM search API and forward events to a centralized SIEM for correlation.
- Track cache refresh events in getFederationConfig and pair them with the identity of subsequent federated callers.
- Baseline normal federated query volumes per user and alert on deviations that suggest cross-user data access.
How to Mitigate CVE-2026-71468
Immediate Actions Required
- Apply the fixed acm-search-v2-api-rhel9 build as published in the Red Hat Security Advisory CVE-2026-71468.
- Restrict network access to the ACM search API to trusted administrative sources until patching completes.
- Rotate bearer tokens and service account credentials that may have been cached by the vulnerable function.
Patch Information
Red Hat tracks the fix under Bug #2512147. Consult the vendor advisory for the specific package versions that resolve the token caching behavior in getFederationConfig and coordinate rollout across all managed hubs.
Workarounds
- Reduce the federation cache time-to-live to shrink the window in which a cached token can be reused.
- Temporarily disable federated search across managed hubs if patching cannot be completed promptly.
- Enforce short-lived tokens and audit RBAC bindings on managed hubs to limit the blast radius of any reused credential.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
