CVE-2026-76827

Awaiting Analysis Awaiting Analysis - Queue

Search-Indexer Data Tampering Vulnerability

Publication date: 2026-08-19

Last updated on: 2026-09-05

Assigner: redhat-SADP

Description

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-09-05

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76827

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	advanced_cluster_management_for_kubernetes	From 2026-08-19 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is in search-indexer where a registered and authenticated managed cluster can tamper with or delete another cluster's indexed search data. It occurs because the delta-sync write paths do not properly restrict UPDATE or DELETE operations to data owned by the calling cluster. An attacker could exploit this by using crafted user identifiers with a different cluster's prefix.

Detection Guidance

This vulnerability involves improper access control in search-indexer where authenticated users can modify or delete another cluster's data. Detection requires checking search-indexer logs for unauthorized UPDATE/DELETE operations on indexed search data, particularly involving mismatched cluster UIDs. Review logs for suspicious activity where a cluster's UID prefix does not match the expected owner.

Impact Analysis

If exploited, this vulnerability could allow unauthorized modification or deletion of another cluster's search data, potentially leading to data loss, incorrect search results, or disruption of services relying on indexed data.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data tampering or deletion, which may violate integrity requirements in standards like GDPR or HIPAA. Unauthorized changes to indexed data could lead to non-compliance with data protection and integrity provisions.

Mitigation Strategies

Apply the latest patches or updates for search-indexer to fix the improper restriction in delta-sync write paths. Ensure proper access controls are enforced to prevent unauthorized UPDATE/DELETE operations on indexed search data.

Hi! I’m here to help you understand CVE-2026-76827. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70