CVE-2026-71469: Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-12 · updated 2026-10-24
Weakness: CWE-770

Description

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.11: all versions — fixed in 1787689524
Red Hat Advanced Cluster Management for Kubernetes 2.13: all versions — fixed in 1787263804
Red Hat Advanced Cluster Management for Kubernetes 2.14: all versions — fixed in 1786723845
Red Hat Advanced Cluster Management for Kubernetes 2.15: all versions — fixed in 1787238618
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1787191668
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1787229541

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.11 1787689524; Red Hat Advanced Cluster Management for Kubernetes 2.13 1787263804; Red Hat Advanced Cluster Management for Kubernetes 2.14 1786723845; Red Hat Advanced Cluster Management for Kubernetes 2.15 1787238618; Red Hat Advanced Cluster Management for Kubernetes 2.16 1787191668; Red Hat Advanced Cluster Management for Kubernetes 2.17 1787229541. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-71469 or the next vulnerability affects your stack