Description

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-12T22:17:15.890Z",
  "pubdate": "2026-08-12T22:17:15.890Z",
  "executiveSummary": "A remote code execution vulnerability has been identified in acm-search-v2-rhel9. This security flaw enables an attacker who possesses administrative privileges and patch access to the Search Custom Resource on the hub cluster to manipulate container image deployment specifications. By leveraging the Collector.ImageOverride field improperly, malicious actors can force the deployment of arbitrary container images across all connected managed clusters. The primary impact of this vulnerability encompasses full remote code execution throughout the managed cluster fleet, leading to potential unauthorized command execution and unauthorized access to sensitive operational and application data across the entire multi-cluster infrastructure. Exploitation strictly requires pre-existing administrative privileges and patch access capabilities targeted specifically at the Search Custom Resource within the hub cluster environment, representing a significant escalation vector for compromised administrative accounts.",
  "technicalDetails": "The vulnerability resides within the acm-search-v2-rhel9 component, specifically stemming from insufficient validation and improper handling of configuration inputs within the Collector.ImageOverride field. The root cause is centered around the lack of integrity checks and restriction enforcement on image references supplied via the Search Custom Resource on the hub cluster. Authentication requirements dictate that the attacker must already possess administrative privileges on the hub cluster alongside explicit patch access authorization to modify the target Search Custom Resource. Because the hub cluster orchestrates and propagates configurations downward to downstream managed clusters, any payload injected into the configuration parameters is automatically distributed globally. The exploitation flow proceeds as follows: First, the authenticated attacker accesses the hub cluster API and initiates a patch operation targeting the Search Custom Resource. Second, the attacker inserts a malicious or arbitrary container image reference into the Collector.ImageOverride field. Third, the orchestration engine processes this updated Custom Resource and propagates the modified collector deployment manifests to all enrolled managed clusters. Fourth, the managed clusters pull and instantiate the specified arbitrary container image within their respective environments. The payload behavior involves executing malicious code embedded within the unauthorized container image context upon deployment. Post-exploitation impact is severe, granting the adversary remote code execution capabilities across the entire fleet of managed clusters, thereby facilitating lateral movement, cluster-wide compromise, and widespread exposure of sensitive data assets managed within the infrastructure."
}