CVE-2026-71470: Search-v2-operator Privilege Escalation

CVE-2026-71470 Overview

CVE-2026-71470 is a privilege escalation flaw in the search-v2-operator, a component used within Red Hat Advanced Cluster Management environments. The vulnerability allows a Custom Resource (CR) editor to manipulate Search CR fields, including imageOverride, arguments, and environment variables, without proper validation. An attacker with CR editor privileges can mount arbitrary secrets into a search container or replace the container image with an attacker-controlled one. The operator's ServiceAccount holds extensive impersonation permissions, so successful exploitation can lead to full cluster compromise. The issue is tracked as [CWE-913: Improper Control of Dynamically-Managed Code Resources].

Critical Impact
Exploitation grants attackers cluster-wide control through ServiceAccount impersonation, escalating from CR editor to cluster administrator.

Affected Products

Red Hat search-v2-operator
Red Hat Advanced Cluster Management deployments incorporating the affected operator
Kubernetes clusters running the vulnerable Search CR controller

Discovery Timeline

2026-08-19 - CVE-2026-71470 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71470

Vulnerability Analysis

The search-v2-operator reconciles Search Custom Resources and translates user-supplied fields into container specifications. The controller accepts fields such as imageOverride, arguments, and environment variable references without enforcing validation or restricting privileged values. A user with permission to edit Search CRs, a role that is typically namespace-scoped and considered lower-privilege, can supply arbitrary values that the operator applies to workloads running under a highly privileged ServiceAccount.

Because the operator ServiceAccount holds impersonation permissions across the cluster, the resulting pod inherits the ability to act as other identities, including cluster-admin equivalents. This transforms a namespace-level editor into an effective cluster administrator.

Root Cause

The root cause is missing input validation on Search CR fields that directly control pod specifications. The operator treats CR editors as trusted for image references, container arguments, and environment sources such as envFrom secret mounts. No allow-list or admission-time policy constrains these fields, so untrusted input flows into the reconciled Deployment specification.

Attack Vector

An authenticated user with CR editor rights modifies a Search CR to set imageOverride to a malicious registry image, or adds envFrom references pointing to sensitive secrets in other namespaces. The operator reconciles the change and starts a pod running the attacker image or exposing the target secrets. The pod inherits the operator ServiceAccount's impersonation rights, which the attacker then uses to authenticate as privileged principals and pivot across the cluster. Full exploitation details are available in the Red Hat CVE-2026-71470 Advisory and Red Hat Bugzilla ID 2512149.

Detection Methods for CVE-2026-71470

Indicators of Compromise

Search CR objects containing an imageOverride value that references an unexpected or external container registry.
Search pods pulling images that do not match the approved Red Hat Advanced Cluster Management image digests.
Unexpected envFrom or env.valueFrom.secretKeyRef entries in Search CRs referencing secrets outside the operator's namespace.
Kubernetes audit events showing token requests or impersonation actions originating from the search-v2-operator ServiceAccount.

Detection Strategies

Monitor the Kubernetes audit log for update and patch operations on Search CRs, filtering for changes to imageOverride, arguments, and environment fields.
Alert on any pod spawned by the operator that runs an image outside the approved registry allow-list.
Correlate ServiceAccount token usage with pod identities to detect impersonation calls originating from Search workloads.

Monitoring Recommendations

Forward Kubernetes API audit logs and container runtime events to a centralized SIEM for behavioral analysis.
Baseline expected images, arguments, and environment references for the search-v2-operator and alert on deviations.
Track TokenRequest and impersonate verbs used by the operator ServiceAccount to detect abuse in near real time.

How to Mitigate CVE-2026-71470

Immediate Actions Required

Restrict RBAC so that only trusted administrators hold edit or patch permissions on Search CRs in namespaces where the operator runs.
Audit existing Search CR objects for unexpected imageOverride, arguments, or environment values and revert unauthorized modifications.
Rotate any secrets that may have been exposed through malicious envFrom references in Search CRs.

Patch Information

Red Hat has assigned CVE-2026-71470 and is tracking remediation through Bugzilla ID 2512149. Consult the Red Hat CVE-2026-71470 Advisory for the current list of fixed operator versions and apply the vendor-supplied update through the operator lifecycle manager.

Workarounds

Deploy an admission controller policy, such as Kyverno or OPA Gatekeeper, that blocks Search CRs specifying imageOverride values outside an approved registry allow-list.
Enforce policies denying envFrom and secretKeyRef entries in Search CRs that reference secrets outside the operator namespace.
Reduce the operator ServiceAccount's impersonation rights to the minimum required scope until the patched version is deployed.

bash

# Example Kyverno policy fragment restricting imageOverride on Search CRs
# Apply with: kubectl apply -f restrict-search-image.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-search-imageoverride
spec:
  validationFailureAction: Enforce
  rules:
    - name: allow-only-approved-registry
      match:
        any:
          - resources:
              kinds:
                - Search
      validate:
        message: "imageOverride must reference registry.redhat.io"
        pattern:
          spec:
            imageOverride: "registry.redhat.io/*"