CVE-2026-71468

medium Red Hat
CVSS v3 Base Score
5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
None
Availability
None
Published: August 11, 2026 (26 days ago)
Last Modified: August 11, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.

CWE

CWE-266

Affected Products

Red Hat Advanced Cluster Management for Kubernetes 2

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov