CVE-2026-71470

Name of the Vulnerable Software and Affected Versions search-v2-operator (affected versions not specified)

Description A flaw in the search-v2-operator allows a privileged user with Custom Resource (CR) editor permissions to manipulate Search CR fields without proper validation. The affected fields include imageOverride, arguments, and environment variables. An attacker can exploit this to mount arbitrary secrets into a search container's environment or replace the container image with one under their control. This leads to privilege escalation and potential full cluster compromise because the ServiceAccount possesses extensive impersonation permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.