CVE-2026-71472: acm-search-v2-rhel9 RCE Vulnerability

CVE-2026-71472 Overview

CVE-2026-71472 is a command injection vulnerability in the acm-search-v2-rhel9 component of Red Hat Advanced Cluster Management. The flaw allows an authenticated attacker with hub administrator or Search Custom Resource (CR) editor privileges to inject malicious shell commands or SQL statements. The WORK_MEM string supplied through the Search CR is not validated before being embedded in a bash script and an SQL query. Successful exploitation results in arbitrary code execution inside the privileged postgres pod, which can compromise the underlying cluster.

Critical Impact
An authenticated attacker can execute arbitrary shell commands and SQL statements within the privileged postgres pod, leading to full system compromise.

Affected Products

Red Hat Advanced Cluster Management acm-search-v2-rhel9 component
Deployments exposing the Search Custom Resource to hub administrators or CR editors
Environments running the privileged postgres pod managed by ACM Search

Discovery Timeline

2026-08-17 - CVE-2026-71472 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71472

Vulnerability Analysis

The vulnerability resides in how acm-search-v2-rhel9 processes the WORK_MEM value defined in the Search Custom Resource. The application passes the attacker-controlled string directly into a bash script and an SQL query without sanitization or parameterization. This dual-context injection surface enables both operating system command injection and SQL injection through a single input field. The issue is classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Exploitation requires authentication but does not require user interaction. Because the postgres pod runs with elevated privileges, injected commands execute with the pod's service account permissions. The scope change reflects that a successful attack can pivot from the Search component into other cluster resources.

Root Cause

The root cause is the absence of input validation on the WORK_MEM field before it is interpolated into a shell command and an SQL statement. The component treats configuration values from the Search CR as trusted, despite the CR being writable by non-cluster-admin roles. Neither shell metacharacter escaping nor SQL parameter binding is applied.

Attack Vector

An attacker with hub administrator or Search CR editor privileges modifies the Search CR to include shell metacharacters or SQL delimiters in the WORK_MEM field. When the search operator reconciles the CR, the tainted value is written into the bash startup script and passed to PostgreSQL. Command execution occurs inside the postgres pod, granting the attacker code execution with the pod's mounted secrets and network reachability. Refer to the Red Hat CVE-2026-71472 Advisory for component-specific details.

Detection Methods for CVE-2026-71472

Indicators of Compromise

Unexpected modifications to Search Custom Resources containing shell metacharacters such as ;, `, $(), or | in the WORK_MEM field
Anomalous process execution inside the search-postgres pod, particularly shells or network utilities spawned from the postgres startup script
Outbound network connections originating from the postgres pod to unexpected destinations
Kubernetes audit log entries showing Search CR updates by non-administrative accounts

Detection Strategies

Enable Kubernetes audit logging for update and patch operations on Search CR resources and alert on non-standard WORK_MEM values
Deploy runtime workload protection on cluster nodes to identify unauthorized process execution inside the postgres pod
Correlate PostgreSQL logs with pod process telemetry to identify SQL statements that produce shell activity

Monitoring Recommendations

Baseline the expected values of WORK_MEM and alert on deviations containing non-numeric characters
Monitor RoleBinding and ClusterRoleBinding changes that grant Search CR edit access
Track child processes of the postgres container entrypoint and flag interactive shells

How to Mitigate CVE-2026-71472

Immediate Actions Required

Restrict edit access to Search Custom Resources to trusted cluster administrators only
Audit existing Search CR objects for suspicious WORK_MEM values and revert unauthorized changes
Apply Red Hat security updates for acm-search-v2-rhel9 as soon as they are available
Rotate credentials and service account tokens accessible from the search-postgres pod if compromise is suspected

Patch Information

Consult the Red Hat CVE-2026-71472 Advisory and Red Hat Bug Report #2512151 for the current patch status and fixed package versions.

Workarounds

Remove the Search CR editor role from users who do not require it and enforce least privilege on the hub cluster
Implement admission control policies that validate the WORK_MEM field against a numeric-only regular expression
Isolate the search-postgres pod with network policies restricting egress to only required destinations

bash

# Example admission policy to enforce numeric WORK_MEM values
# Applied via a validating admission webhook or Kyverno/OPA policy
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: validate-search-workmem
spec:
  validationFailureAction: enforce
  rules:
    - name: check-workmem-format
      match:
        resources:
          kinds:
            - Search
      validate:
        message: "WORK_MEM must be a numeric value with optional MB/GB suffix"
        pattern:
          spec:
            deployments:
              search-postgres:
                envVar:
                  WORK_MEM: "?*[0-9]MB | ?*[0-9]GB"