# CVE-2026-71473

## Summary

- **CVE ID:** CVE-2026-71473
- **Severity:** HIGH
- **CVSS Score:** 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)
- **CWE:** CWE-915
- **Published:** Aug 12, 2026
- **Last Modified:** Sep 5, 2026

## Description

A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.

## Affected Products

- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.13 (1787682112)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.15 (1787681674)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.17 (1787681651)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.11 (1787688827)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.14 (1787682033)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.16 (1787681686)

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-71473)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2512152)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60386)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60389)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60390)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60387)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60388)
- [CNA](https://access.redhat.com/errata/RHSA-2026:60391)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.35%
- **EPSS Percentile:** 27.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._