CVE-2026-71473

{"id": "CVE-2026-71473", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71473", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:35:34.370769Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787688827", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787682112", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787682033", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787681674", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787681686", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787681651", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/acm-search-v2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-12T22:17:16.020", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-71473", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512152", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente \u201csearch-v2-operator\u201d. Un usuario con permisos administrativos espec\u00edficos en un cl\u00faster gestionado puede explotar una vulnerabilidad que le permite inyectar datos de configuraci\u00f3n arbitrarios. Esta manipulaci\u00f3n puede sobrescribir configuraciones cr\u00edticas, lo que lleva al reemplazo de im\u00e1genes de contenedor. Esto en \u00faltima instancia resulta en la inyecci\u00f3n de im\u00e1genes de contenedor en el cl\u00faster gestionado, comprometiendo potencialmente su integridad."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "secalert@redhat.com"}