VDB

CVE-2026-71468

CVE-2026-71468 PUBLISHED CVSS 5.3 MEDIUM

Reported by redhat · Published August 11, 2026

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.

Risk Scores

CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.111787689524
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.131787263804
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141786723845
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.151787238618
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.161787191668
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171787229541
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141786723845
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.151787238618
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.131787263804
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.111787689524
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171787229541
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.161787191668

Timeline

  • Aug 11, 2026 CVE Published
  • Aug 12, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 27, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Distribution Patch
  • Sep 6, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›