CVE-2026-71468: Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-266

Description

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787689524
Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787263804
Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1786723845
Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238618
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787191668
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787229541

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.11 1787689524; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263804; Red Hat Advanced Cluster Management for Kubernetes 2.14 1786723845; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238618; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787191668; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787229541. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-71468 or the next vulnerability affects your stack