CVE-2026-70495

Name of the Vulnerable Software and Affected Versions search-v2-operator (affected versions not specified)

Description A flaw exists in the search-v2-operator where the search-serviceaccount is assigned overly broad permissions. This allows for the impersonation of users and groups across the entire cluster. An attacker who gains access to any pod utilizing this service account can leverage these permissions to obtain system:masters access, resulting in full administrative control over the cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.