CVE-2026-70495
Received Received - Intake

Privilege Escalation in search-v2-operator

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: redhat-SADP

Description
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-70495
EUVD
EUVD-2026-60361

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat search-v2-operator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the search-v2-operator component where the search-serviceaccount has excessive permissions. It can impersonate users and groups across the entire cluster. If an attacker gains access to any pod running under this service account, they can escalate privileges to gain full cluster control, including system:masters access.

Detection Guidance

Detecting this vulnerability requires checking for pods running under the search-serviceaccount in the search-v2-operator component. Inspect pod configurations for excessive permissions or cluster-wide impersonation capabilities. Use commands like 'kubectl get pods --all-namespaces -o wide' to list pods and 'kubectl describe pod <pod-name> -n <namespace>' to review service account assignments and permissions.

Impact Analysis

If an attacker compromises one of the pods using the vulnerable service account, they can take over the entire cluster. This requires the attacker to already have access to the pod, but once inside, they can escalate privileges to gain full administrative control.

Compliance Impact

This vulnerability could significantly impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. Full cluster control via system:masters access could allow attackers to exfiltrate, modify, or delete regulated data, violating confidentiality and integrity requirements. GDPR's data protection principles and HIPAA's access controls may be compromised if such an attack occurs.

Mitigation Strategies

Immediate mitigation steps are not specified in the provided resources. Red Hat notes mitigation options are unavailable or do not meet usability criteria. Monitor official updates from Red Hat or the stolostron/search-v2-operator project for patches or workarounds. Isolate affected pods if possible and restrict access to cluster resources until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart