by Kastro CVE-2026-70496
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 — Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork
Description · from the CVE record
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
Affected
ProductAffectedFixed inSource
Red Hat Advanced Cluster Management for Kubernetes 2.11see advisory1787688827CNA
Red Hat Advanced Cluster Management for Kubernetes 2.13see advisory1787682112CNA
Red Hat Advanced Cluster Management for Kubernetes 2.14see advisory1787682033CNA
Red Hat Advanced Cluster Management for Kubernetes 2.15see advisory1787681674CNA
Red Hat Advanced Cluster Management for Kubernetes 2.16see advisory1787681686CNA
Red Hat Advanced Cluster Management for Kubernetes 2.17see advisory1787681651CNA
Red Hat Advanced Cluster Management for Kubernetes 2.17see advisory1787229539CNA
Red Hat Advanced Cluster Management for Kubernetes 2see advisory–CNA
Scores by source
redhat (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total