What’s Vulnerable › Vulnerabilities

CVE-2026-71467: Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-287

Description

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787229541

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.17 1787229541. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:60386
• https://access.redhat.com/security/cve/CVE-2026-71467
• https://bugzilla.redhat.com/show_bug.cgi?id=2512146

Get alerted when CVE-2026-71467 or the next vulnerability affects your stack