CVE-2026-71473: search-v2-operator RCE Vulnerability

CVE-2026-71473 Overview

CVE-2026-71473 is a configuration injection vulnerability in the search-v2-operator component used within managed Kubernetes clusters. An authenticated user holding specific administrative permissions on a managed cluster can inject arbitrary configuration data into the operator. The injected values override critical settings and enable replacement of container images running on the cluster. Successful exploitation results in container image injection, allowing an attacker to run attacker-controlled workloads and compromise cluster integrity. The flaw is tracked under CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes.

Critical Impact
Attackers with administrative privileges on a managed cluster can replace legitimate container images with malicious ones, subverting workloads and pivoting deeper into the environment.

Affected Products

Red Hat search-v2-operator component
Managed Kubernetes clusters running the affected operator
Deployments consuming operator-managed search components

Discovery Timeline

2026-08-12 - CVE CVE-2026-71473 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-71473

Vulnerability Analysis

The search-v2-operator accepts configuration input from users with specific administrative permissions on the managed cluster. The operator does not adequately restrict which object attributes can be modified through that interface. As a result, a user can inject configuration values that override fields controlling container image references. When the operator reconciles the resource, it deploys the attacker-specified images instead of the intended ones. This provides a direct path from configuration write access to arbitrary workload execution inside the cluster.

Because the attack changes CVSS scope, the impact reaches beyond the operator itself and can affect other components running on the managed cluster.

Root Cause

The root cause maps to [CWE-915], where dynamically-determined object attributes are modified without sufficient control over which attributes can be set. The operator trusts caller-supplied configuration fields that should be immutable or restricted, allowing image-related settings to be overwritten through normal configuration flows.

Attack Vector

The attack is network-reachable and requires low-privilege authentication against the cluster API, provided the caller holds the specific administrative role recognized by the operator. No user interaction is required. The attacker submits crafted configuration data that overrides container image settings. On the next reconcile, the operator schedules workloads using the attacker-controlled image. Refer to the Red Hat CVE-2026-71473 advisory and Red Hat Bug Report #2512152 for vendor detail.

Detection Methods for CVE-2026-71473

Indicators of Compromise

Unexpected container image references in search-v2-operator-managed resources, particularly images from registries not on the approved allowlist.
Pod restarts or rollout events on operator-managed workloads correlated with configuration changes made by administrative accounts.
Outbound network connections from operator-managed pods to unfamiliar hosts or registries.

Detection Strategies

Audit Kubernetes API server logs for update and patch operations targeting search-v2-operator custom resources and diff the image fields against the expected baseline.
Deploy admission controllers such as OPA Gatekeeper or Kyverno to alert when image fields on operator-managed resources deviate from approved registries.
Correlate RBAC-authenticated administrative actions with subsequent image pulls from non-standard registries.

Monitoring Recommendations

Continuously monitor container image provenance and enforce signature verification on all operator-deployed workloads.
Track changes to operator CustomResources through GitOps reconciliation and flag out-of-band edits.
Alert on privilege use by administrative service accounts outside normal maintenance windows.

How to Mitigate CVE-2026-71473

Immediate Actions Required

Apply the fixed search-v2-operator version as published in the Red Hat CVE-2026-71473 advisory once available for your channel.
Review and reduce the set of accounts holding the administrative permissions required to modify search-v2-operator configuration.
Inspect running workloads managed by the operator and verify that all container images match the expected registries and digests.

Patch Information

Red Hat tracks remediation for this issue in Bug #2512152. Consult the Red Hat CVE-2026-71473 advisory for the affected package versions, fixed builds, and channel-specific update instructions.

Workarounds

Restrict RBAC so only trusted principals can modify search-v2-operator custom resources on managed clusters.
Enforce an admission policy that pins container images to approved registries and rejects overrides on operator-managed resources.
Use image signature verification (for example, Sigstore Cosign) to block deployment of unsigned or unauthorized images.

bash

# Example Kyverno policy fragment to restrict images on operator-managed resources
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-search-operator-images
spec:
  validationFailureAction: Enforce
  rules:
    - name: allowed-registries
      match:
        any:
          - resources:
              kinds:
                - Pod
              namespaces:
                - open-cluster-management-agent-addon
      validate:
        message: "Images must come from approved registries"
        pattern:
          spec:
            containers:
              - image: "registry.redhat.io/* | quay.io/stolostron/*"