Description (CNA)
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 | unaffected 1787689524 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1787263804 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected 1786723845 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.15 | unaffected 1787238618 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16 | unaffected 1787191668 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17 | unaffected 1787229541 before * |
CWE
CWE-266
References
- https://access.redhat.com/errata/RHSA-2026:60386
- https://access.redhat.com/errata/RHSA-2026:60387
- https://access.redhat.com/errata/RHSA-2026:60388
- https://access.redhat.com/errata/RHSA-2026:60389
- https://access.redhat.com/errata/RHSA-2026:60390
- https://access.redhat.com/errata/RHSA-2026:60391
- https://access.redhat.com/security/cve/CVE-2026-71468
- https://bugzilla.redhat.com/show_bug.cgi?id=2512147
ADP enrichment
No English description supplied.
No references supplied.