VDB

CVE-2026-70495

CVE-2026-70495 PUBLISHED CVSS 8.8 HIGH

Reported by redhat · Published August 17, 2026

A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.

Risk Scores

CVSS 3.1
8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.111787688827
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.131787682112
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141787682033
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.151787681674
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.161787681686
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171787681651
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141787682033
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.161787681686
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.131787682112
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.151787681674
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.111787688827
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171787681651

Timeline

  • Aug 17, 2026 CVE Published
  • Aug 18, 2026 EPSS Score
  • Aug 18, 2026 Coalition ESS Score
  • Aug 27, 2026 EPSS Score
  • Aug 27, 2026 CVE Updated
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›