by Kastro CVE-2026-71472
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 — Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem
Description · from the CVE record
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.
Affected
ProductAffectedFixed inSource
Red Hat Advanced Cluster Management for Kubernetes 2.11see advisory1787688827CNA
Red Hat Advanced Cluster Management for Kubernetes 2.13see advisory1787682112CNA
Red Hat Advanced Cluster Management for Kubernetes 2.14see advisory1787682033CNA
Red Hat Advanced Cluster Management for Kubernetes 2.15see advisory1787681674CNA
Red Hat Advanced Cluster Management for Kubernetes 2.16see advisory1787681686CNA
Red Hat Advanced Cluster Management for Kubernetes 2.17see advisory1787681651CNA
Scores by source
redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total