Description
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | — | — |
References
- RHSA-2026:60386 vendor-advisory
- RHSA-2026:60387 vendor-advisory
- RHSA-2026:60388 vendor-advisory
- RHSA-2026:60389 vendor-advisory
- RHSA-2026:60390 vendor-advisory
- RHSA-2026:60391 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-71468 vdb-entry
- RHBZ#2512147 issue-tracking