CVE-2026-70496

Published: Aug 19, 2026Modified: Aug 27, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.

Related CWEs

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (8)

https://access.redhat.com/errata/RHSA-2026:60386

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60387

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60388

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60389

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60390

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:60391

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-70496

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2511032

Source: secalert@redhat.com

Timeline

No history available yet.