Description

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-19T17:20:57.063Z",
  "pubdate": "2026-08-19T17:20:57.063Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in the search-v2-operator. The flaw arises due to insufficient input validation on Custom Resource (CR) fields, specifically allowing users with Custom Resource (CR) editor privileges to manipulate configuration parameters such as imageOverride, arguments, and environment variables.\nBy successfully exploiting this vulnerability, a malicious actor possessing CR editing permissions can inject arbitrary secrets into the environment of the search container or substitute the legitimate container image with an attacker-controlled image.\nThe impact of this vulnerability is severe, leading to full privilege escalation within the targeted environment. Because the associated ServiceAccount possesses extensive impersonation permissions, exploitation can ultimately culminate in a complete cluster compromise.\nPrerequisites for exploitation require the attacker to already hold privileged user status specifically as a Custom Resource editor within the cluster. Mitigation requires implementing proper input validation and sanitization mechanisms within the search-v2-operator to restrict unauthorized modification of sensitive CR fields.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of strict input validation and sanitization within the search-v2-operator when processing Custom Resource (CR) fields. Specifically, the operator fails to enforce adequate security constraints on configuration parameters including imageOverride, arguments, and environment variables.\nThe vulnerable component is the search-v2-operator, which governs the lifecycle and deployment of search-related components. Authentication and authorization requirements dictate that the attacker must possess a privileged user context, specifically functioning as a Custom Resource (CR) editor capable of modifying the targeted search CRs.\nThe attack flow proceeds as follows: First, the attacker leverages their existing Custom Resource editor privileges to interact with the search CR. Second, the attacker maliciously modifies sensitive fields within the CR manifest, injecting unauthorized configuration payloads such as arbitrary environment variables or referencing a malicious container image via the imageOverride parameter. Third, the search-v2-operator processes the modified CR without properly validating the inputs, subsequently applying the changes to the underlying Kubernetes deployment.\nDuring payload execution, the search container is deployed with the attacker's supplied configuration. This permits the mounting of arbitrary secrets directly into the container's runtime environment or executes an attacker-controlled container image.\nFollowing successful exploitation, the post-exploitation impact is critical. The search container runs with the privileges and context of an associated ServiceAccount that possesses extensive impersonation permissions across the cluster. An attacker who gains control of this container or extracts the mounted secrets can leverage the ServiceAccount's impersonation capabilities to pivot throughout the environment, access sensitive cluster-wide resources, and achieve a full cluster compromise."
}