CVE-2026-71468
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In acm-search-v2-api-rhel9, when the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.
Risk Assessment
Unauthorized access to search results could expose sensitive data about managed clusters, potentially compromising information confidentiality and organizational security policies.
Recommendation
It is recommended to immediately update acm-search-v2-api-rhel9 to a version that does not reuse bearer tokens, and to implement cache expiration mechanisms. Also, monitor logs for unauthorized federated requests.
Original NVD description (English source)
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.