External risk intelligence

Authenticated Command Injection in acm-search-v2-rhel9

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-71472

This vulnerability requires an authenticated attacker with specific administrative or editor privileges, such as a hub administrator or Search Custom Resource editor, to inject commands. Such management and administrative interfaces are typically restricted to internal personnel or protected behind internal access controls, making direct public-internet exposure uncommon.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in acm-search-v2-rhel9 that could allow an authenticated attacker to execute malicious commands. This occurs due to insufficient validation of input used in system scripts and database queries, potentially leading to system compromise.

Flaw allows command injection via unvalidated input.
High impact if exploited; confirms potential for system compromise.
Verify relevance and assess exposure carefully.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges could exploit this vulnerability by manipulating search configurations. By providing unvalidated input within a Search Custom Resource, the attacker can trick the system into executing arbitrary shell commands or SQL statements. This could grant them control over the system by executing code within a privileged database container.

Requires authenticated administrator access.
Triggered by unvalidated search resource input.
Leads to arbitrary code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker, such as a hub administrator or Search Custom Resource editor, could inject malicious shell commands or SQL statements into the WORK_MEM string within a Search CR. When this string is used in a bash script and an SQL query without proper validation, it could lead to arbitrary code execution within the privileged postgres pod.

Arbitrary code execution in postgres pod.
Authenticated attacker injects commands.
System compromise via code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the acm-search-v2-rhel9 component, allowing authenticated administrators to execute arbitrary code. Responsibility likely falls to platform or application owners to identify affected instances, assess their business criticality and exposure, and then coordinate remediation, possibly involving vendor engagement. The initial step is to locate all instances of acm-search-v2-rhel9 within your environment.

Platform or application owners should lead remediation.
Verify instance reachability and business criticality first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is acm-search-v2-rhel9?

This software is a component designed for advanced data search and retrieval within RHEL 9 environments. It functions as part of a larger architecture, often helping manage or index complex information across a platform. In this context, it includes features for querying databases, which is where the security flaw resides.

What does CWE-78 mean for CVE-2026-71472?

CWE-78 refers to OS Command Injection. For this CVE, it means the application fails to properly clean input before passing it to system-level commands or database queries. Because the system trusts the input, it inadvertently executes malicious commands injected by a user, essentially letting an attacker give instructions directly to the underlying host or database.

How is this vulnerability triggered?

An attacker must have existing authenticated access as a hub administrator or Search Custom Resource editor to trigger this bug. They exploit it by inserting malicious shell commands or SQL statements into the 'WORK_MEM' string field of a Search Custom Resource. Simply using the standard search features without modifying these specific resource configurations does not trigger the vulnerability.

Is my system at risk if it is not on the internet?

Halo Surface Signal indicates that because this requires specific administrative or editor credentials, direct exposure to the public internet is uncommon. Most organizations restrict these management interfaces to internal users or private networks. However, internal threats or compromised administrative accounts remain a valid concern regardless of internet connectivity.

What should I do if I run this component?

Your first step is to perform an inventory to locate every instance of acm-search-v2-rhel9 in your environment. Once identified, platform owners should assess the business criticality of those specific instances. After determining the impact, coordinate with your internal security or platform teams to plan remediation, which will likely involve applying updates provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.