Security readout for executives and security teams
Plain-English summary
The search-v2 operator in affected Red Hat Advanced Cluster Management releases receives permissions comparable to a cluster administrator. If its identity is misused, an attacker could take broad control of managed Kubernetes resources, undermine access controls, approve certificates, and affect workloads across the cluster.
Executive priority
Treat as an urgent remediation item for affected ACM environments because the vulnerable operator role can provide cluster-admin-equivalent control. Prioritize internet-facing, shared, production, and high-value clusters. There is no supplied evidence of active exploitation, but the potential impact justifies expedited inventory, vendor-guided updating, and audit review.
Technical view
The operator ClusterRole permits identity impersonation, RBAC writes, CSR approval, and ManifestWork management. These capabilities exceed its intended function and create a privilege-escalation path with cluster-wide confidentiality, integrity, and availability impact. The supplied CVSS 3.1 score is 9.9, with network reachability, low complexity, low privileges, no user interaction, and changed scope.
Likely exposure
Exposure applies to listed acm-search-v2-rhel9 builds for ACM 2.11 and 2.13 through 2.17, plus the listed search-collector-rhel9 build for 2.17. The supplied data marks multiclusterhub-rhel9 unaffected. Deployment state and package build identifiers must be checked locally.
Exploitation context
The CVSS vector indicates a network-accessible, low-complexity path requiring low privileges and no user interaction. Successful abuse could cross security boundaries and gain cluster-admin-equivalent capabilities. The supplied sources do not establish active exploitation, public exploit availability, or inclusion in CISA KEV.
Researcher notes
The core weakness is excessive privilege under CWE-250, not a supplied memory-corruption or injection flaw. Validate effective authorization through ClusterRoleBindings and service-account identity. The bundle provides affected build identifiers and six Red Hat advisories but no explicit fixed-build mapping, exploit details, or confirmed exploitation telemetry.
Mitigation direction
- Identify affected ACM releases and package build identifiers across every managed cluster.
- Review and apply the applicable Red Hat security advisory and vendor-supported update.
- Until updated, tightly restrict access to the operator workload, service account, tokens, and deployment controls.
- Do not manually remove required permissions without confirming supported RBAC changes with Red Hat.
- If misuse is suspected, follow incident procedures and rotate exposed operator credentials after containment.
Validation and detection
- Confirm installed ACM release, image digest, and package build identifiers against the affected entries.
- Inspect the operator ClusterRole and bindings for impersonation, RBAC-write, CSR-approval, and ManifestWork permissions.
- Verify updated package versions against the applicable Red Hat advisory after remediation.
- Review audit logs for unexpected impersonation, RBAC changes, CSR approvals, or ManifestWork actions.
- Confirm the multiclusterhub-rhel9 finding separately; the supplied data marks that package unaffected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-250: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-70496 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16redhatVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:60386CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60387CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60388CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60389CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60390CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:60391CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-70496CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2511032CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Execution with Unnecessary Privileges
Execution with Unnecessary Privileges represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.