CVE-2026-71473

The record

A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.

Affected packages

Related vulnerabilities

• CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-84645 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing… CWE-915
• CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. CWE-915
• CVE-2026-83557 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically… CWE-915
• CVE-2026-78038 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-59284 There is no allow list for property keys when Spring Cloud Commons writable /actuator/env… CWE-915
• CVE-2026-47849 Spring Data REST does not guard identifier (@Id) and version (@Version) properties… CWE-915
• CVE-2026-47850 Spring Data REST does not preserve the persisted version (@Version) property of an… CWE-915