CVE-2026-76827
MediumCVSS 6.8Summary
A vulnerability was found in search-indexer that allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster.
Risk Assessment
An attacker can compromise the integrity of indexed data of other clusters, potentially leading to incorrect search results or data loss.
Recommendation
Apply patches provided by the search-indexer vendor that restrict UPDATE/DELETE operations to owner data.
Original NVD description (English source)
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.