CVE-2026-71467

Summary

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated endpoint with the Upgrade: websocket header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-287: Improper Authentication

Workarounds

To mitigate this vulnerability, ensure the FEATURE_FEDERATED_SEARCH is disabled if not actively used. This feature is off by default in standard deployments of Red Hat Advanced Cluster Management for Kubernetes. For Global Hub deployments where FEATURE_FEDERATED_SEARCH is enabled by default, consider restricting network access to the search-v2-api's /federated endpoint to trusted clients.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References