CVE-2026-70496
CriticalCVSS 9.9Summary
A flaw was found in search-v2-operator: its ClusterRole has permissions equivalent to a cluster administrator, allowing impersonation, RBAC modification, CSR approval, and ManifestWork management, leading to excessive privileges and potential privilege escalation.
Risk Assessment
Excessive operator privileges may allow an attacker to escalate privileges within the cluster, potentially leading to full cluster compromise.
Recommendation
Restrict the operator's ClusterRole to the minimum required permissions and apply vendor-provided fixes.
Original NVD description (English source)
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.