CRITICAL 9.9 NVD
CVE-2026-70496
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entit
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.
References
- https://access.redhat.com/security/cve/CVE-2026-70496
- https://bugzilla.redhat.com/show_bug.cgi?id=2511032
This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-08-19 via NVD.
Risk Timeline
CVE Disclosed2026-08-19 · 0 days ago
Remediation Resources
Official Advisory
access.redhat.com/security/cve/CVE-2026-70496Analysis & PoC
bugzilla.redhat.com/show_bug.cgi?id=2511032
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.