CVE-2026-71469

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-08-12

Last updated on: 2026-08-27

Assigner: redhat-SADP

Description

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-27

Generated

2026-10-12

AI Q&A

2026-08-13

EPSS Evaluated

2026-10-11

NVD

CVE-2026-71469

EUVD

EUVD-2026-57687

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	advanced_cluster_management_for_kubernetes	2.17.1
red_hat	advanced_cluster_management_for_kubernetes	2.14.4
red_hat	advanced_cluster_management_for_kubernetes	2.13.11
red_hat	advanced_cluster_management_for_kubernetes	2.11.11
red_hat	advanced_cluster_management_for_kubernetes	2.15.6
red_hat	advanced_cluster_management_for_kubernetes	2.16.4
stolostron	search-v2-api	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in search-v2-api. An unauthenticated attacker can send requests with random bearer tokens, creating permanent entries in an unbounded cache. This leads to memory exhaustion in the search-api pod, causing service disruption.

Detection Guidance

Monitor for unusual memory usage in the search-api pod. Check logs for excessive unique bearer token requests. Use commands like 'kubectl top pods' to observe memory consumption and 'kubectl logs <pod-name>' to inspect request patterns.

Impact Analysis

The vulnerability can cause your search-api service to crash or become unresponsive due to memory exhaustion. This disrupts normal operations and may lead to downtime for users relying on the service.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by exhausting memory resources through unbounded cache entries. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged DoS conditions could disrupt system availability, potentially violating service-level agreements or operational requirements in regulated environments.

Mitigation Strategies

Implement rate limiting on bearer token requests. Clear the tokenReviews cache periodically. Restrict unauthenticated access to the search-v2-api endpoint. Update to a patched version if available.

Hi! I’m here to help you understand CVE-2026-71469. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70