CVE-2026-71473

Name of the Vulnerable Software and Affected Versions search-v2-operator (affected versions not specified)

Description A flaw in the search-v2-operator component allows a user with specific administrative permissions on a managed cluster to inject arbitrary configuration data. This is possible through the getvaluesfromaddonannotation() function in the addonfactory module, which enables arbitrary helm-values override per spoke. This manipulation can override critical settings and lead to the replacement of container images, potentially compromising the integrity of the managed cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.