Description

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-19T21:17:39.227Z",
  "pubdate": "2026-08-19T21:17:39.227Z",
  "executiveSummary": "An access control vulnerability has been identified in search-indexer, specifically residing within its delta-sync write paths. This flaw allows a registered and authenticated managed cluster to perform unauthorized UPDATE and DELETE operations against indexed search data belonging to entirely separate clusters. The root cause stems from insufficient validation and enforcement of data ownership boundaries during synchronization routines. Consequently, an authenticated attacker possessing valid cluster credentials can manipulate or destroy foreign search records, leading to severe data integrity compromise, loss of observability, and potential cross-cluster operational disruption within multi-tenant environments. Exploitation requires the attacker to be authenticated as a managed cluster, granting them internal access to the synchronization endpoints. The risk implication is high, as it violates fundamental multi-tenant isolation guarantees by enabling horizontal privilege abuse across distinct cluster trust domains. Remediation requires implementing stringent authorization checks within the delta-sync write paths to ensure that calling entities can only modify or delete data explicitly prefixed by and belonging to their own assigned cluster identifiers.",
  "technicalDetails": "The vulnerability resides within the delta-sync write paths of the search-indexer component, which is responsible for processing and storing indexed search data submitted by managed clusters. The core technical defect is the lack of proper authorization and ownership validation checks during UPDATE and DELETE operations. Specifically, the application fails to verify whether the entity submitting a modification request holds administrative or ownership rights over the target data records being manipulated.\nThe vulnerability can be systematically exploited through the following attack flow. First, an attacker establishes a valid session or obtains credentials as a registered and authenticated managed cluster, fulfilling the baseline authentication requirements. Second, the attacker crafts malicious payloads containing specifically manipulated user identifiers (UIDs). These UIDs are deliberately engineered with prefixes corresponding to a different, victim managed cluster.\nThird, the attacker transmits these crafted UIDs via the delta-sync write paths targeting UPDATE or DELETE endpoints exposed by the search-indexer. Because the vulnerable backend component fails to validate the correlation between the authenticated caller's identity and the prefix embedded within the target record's UID, the application assumes the operation is legitimate.\nFourth, the search-indexer processes the request, resulting in the unauthorized modification, overwrite, or deletion of the victim cluster's indexed search data. The post-exploitation impact includes the corruption of search indexes, denial of visibility into affected cluster resources, and potential cascading failures in monitoring or management planes relying on the integrity of the search-indexer data store. The affected component relies on network exposure accessible to registered managed clusters, requiring valid authentication but circumventing horizontal privilege boundaries."
}