External risk intelligence

acm-search-v2-rhel9 Collector ImageOverride RCE on Managed Clusters.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-71471

The vulnerability requires administrative privileges on the hub cluster and specific access to modify Custom Resources. It is an internal management/administrative function within a cluster orchestration environment, not a public-facing service or internet-exposed endpoint.

Remote Code Execution

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability within acm-search-v2-rhel9 that could allow an attacker with administrative access to deploy arbitrary code across all managed clusters, potentially leading to the compromise of sensitive information. The core issue involves unauthorized deployment of container images through a specific configuration field, enabling remote code execution.

Attackers can deploy their own code anywhere.
Administrative privilege allows widespread compromise.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to a hub cluster could exploit a flaw in the Search Custom Resource's `Collector.ImageOverride` field. This allows them to deploy any container image, leading to code execution on all connected managed clusters.

Requires administrative cluster access.
Triggered by modifying a Search Custom Resource.
Leads to fleet-wide code execution.

Live Threat

Current exploitation, exposure, and threat context

An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This could allow the attacker to deploy an arbitrary container image, leading to remote code execution (RCE) and potential access to sensitive information across all managed clusters.

Fleet-wide container execution.
Deploy arbitrary container images.
Execute commands remotely.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts systems where `acm-search-v2-rhel9` is deployed, potentially affecting the security of all managed clusters. The primary responsibility for addressing this issue likely falls to the platform engineering or cluster administration teams who manage the hub cluster and its associated custom resources. The first crucial step is to identify all instances of the affected technology, confirm their reachability and criticality within the environment, and then ascertain the accountable owner for remediation planning.

Platform or cluster administrators should own this.
Verify hub cluster access and CR reachability.
Plan remediation based on fleet-wide risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is acm-search-v2-rhel9 used for?

The acm-search-v2-rhel9 component is part of a platform designed for multicluster management. It facilitates fleet-wide search capabilities, allowing administrators to query and monitor resources across multiple managed clusters from a central hub. It functions as an orchestration tool that synchronizes search data to provide visibility into distributed containerized environments.

What does CVE-2026-71471 mean for security?

This vulnerability is classified as CWE-829, which involves the inclusion of functionality from an untrusted or improperly controlled source. Specifically, the flaw allows someone to manipulate the Collector.ImageOverride configuration field. Because the system trusts this input, it will inadvertently deploy and execute arbitrary container images chosen by the attacker across the entire managed fleet, resulting in remote code execution.

How is this vulnerability triggered?

The flaw is triggered only when an actor who already possesses administrative privileges on the hub cluster performs a specific action: patching the Search Custom Resource. It cannot be exploited by unauthenticated users or those without sufficient cluster permissions. Simply having the software installed does not trigger the bug; it requires active, unauthorized modification of the specific configuration field.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited from the public internet. Because it requires administrative-level access to the hub cluster's internal management functions, it is not an internet-exposed endpoint. You should focus your assessment on internal users and service accounts that hold high-level permissions to modify cluster resources.

What should I do to respond to this issue?

First, engage your platform engineering or cluster administration teams to identify where acm-search-v2-rhel9 is deployed in your environment. Confirm which users or service accounts have patch access to the Search Custom Resource. Once identified, audit those access rights and prioritize remediation planning to ensure that configuration inputs are strictly validated and unauthorized code deployment is prevented.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.