CVE-2026-71467

Summary

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated endpoint with the Upgrade: websocket header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171787229541 < *unaffected

Weaknesses

  • CWE-287: Improper Authentication

Workarounds

To mitigate this vulnerability, ensure the FEATURE_FEDERATED_SEARCH is disabled if not actively used. This feature is off by default in standard deployments of Red Hat Advanced Cluster Management for Kubernetes. For Global Hub deployments where FEATURE_FEDERATED_SEARCH is enabled by default, consider restricting network access to the search-v2-api's /federated endpoint to trusted clients.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References