CVE-2026-71467

Name of the Vulnerable Software and Affected Versions search-v2-api (affected versions not specified)

Description An authentication bypass exists in the authentication middleware of the affected component. The system unconditionally skips authentication checks when a request contains an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a crafted HTTP POST request to the /federated endpoint including the Upgrade: websocket header, allowing unauthorized access to federated search results across all configured remote managed hubs and resulting in information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /federated endpoint to minimize the risk of exploitation.