Description

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T20:16:45.777Z",
  "pubdate": "2026-08-17T20:16:45.777Z",
  "executiveSummary": "A critical injection vulnerability has been identified in acm-search-v2-rhel9, specifically residing within the handling of the Search Custom Resource (CR). This flaw allows an authenticated attacker possessing elevated privileges, such as a hub administrator or a Search CR editor, to execute arbitrary shell commands and inject malicious SQL statements. The vulnerability stems from improper input validation and sanitization of the WORK_MEM string parameter supplied within the Search CR. When processed, this unsanitized string is directly concatenated into an underlying bash script and a database SQL query, bypassing security boundaries.\nThe impact of successful exploitation is severe, leading to arbitrary code execution directly within the context of the privileged postgres pod. This level of access can result in complete system compromise, unauthorized database manipulation, privilege escalation, and potential lateral movement across the cluster infrastructure. Exploitation requires authenticated access with specific administrative or editing capabilities over the Search Custom Resource, meaning the attack vector relies on compromised or malicious high-privileged accounts rather than unauthenticated external access.",
  "technicalDetails": "The vulnerability in acm-search-v2-rhel9 is categorized as an improper input validation flaw leading to simultaneous command injection and SQL injection. The vulnerable component is the processing logic responsible for parsing the WORK_MEM parameter defined within the Search Custom Resource (CR).\nRoot Cause: The application accepts the WORK_MEM string from the Search CR without enforcing strict validation, type checking, or allow-listing. This unsanitized input is subsequently passed directly into a bash script execution context and embedded into an active SQL query string without parameterized queries or proper escaping.\nAuthentication and Privileges: Exploitation of this vulnerability requires the attacker to be authenticated and possess specific authorization, specifically operating as a hub administrator or a Search CR editor capable of modifying or creating Search Custom Resources within the targeted environment.\nAttack Flow: 1. The attacker crafts a malicious Search Custom Resource payload containing carefully engineered shell command sequences or SQL syntax within the WORK_MEM string. 2. The attacker submits or updates the crafted Search CR against the acm-search-v2-rhel9 deployment. 3. The backend automation processes the CR, extracting the malicious WORK_MEM string without prior sanitization. 4. The unsanitized string is injected into the execution flow of a bash script, triggering arbitrary command execution at the operating system level. Simultaneously, the string is evaluated within an SQL execution context, resulting in SQL injection. 5. The malicious commands execute within the context of the privileged postgres pod.\nPost-Exploitation Impact: Because the affected postgres pod operates with elevated privileges, successful command execution allows the attacker to read sensitive database contents, modify system configurations, extract stored secrets, potentially pivot to underlying node infrastructure, and achieve full administrative control over the affected database backend."
}