Privilege Escalation via overpriv ClusterRole in search-v2-operator (Red Hat)
CVE-2026-70496 Published on August 19, 2026
Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
Vulnerability Analysis
CVE-2026-70496 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Timeline
Reported to Red Hat.
Made public. 85 days later.
Weakness Type
Execution with Unnecessary Privileges
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Products Associated with CVE-2026-70496
Want to know whenever a new CVE is published for Red Hat Acm? stack.watch will email you.
Affected Versions
Red Hat Advanced Cluster Management for Kubernetes 2.11:- Version 1787688827 and below * is unaffected.
- Version 1787682112 and below * is unaffected.
- Version 1787682033 and below * is unaffected.
- Version 1787681674 and below * is unaffected.
- Version 1787681686 and below * is unaffected.
- Version 1787681651 and below * is unaffected.
- Version 1787229539 and below * is unaffected.