CVE-2026-71469Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos
- 7.5HighCVSS base score
- 0.74%Exploitation in 30 daysEPSS · top 45% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).
Timeline
ID reserved
By redhat
- 6 days later
· 6 days later
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11
- unaffected 1787689524 – < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.13
- unaffected 1787263804 – < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.14
- unaffected 1786723845 – < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.15
- unaffected 1787238618 – < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.16
- unaffected 1787191668 – < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.17
- unaffected 1787229541 – < *
What to do
Workaround: To mitigate this issue, restrict network access to the `search-v2-api` component within Red Hat Advanced Cluster Management for Kubernetes. Implement network policies to limit incoming connections to only trusted sources that require access to the search API. This will reduce the attack surface for unauthenticated denial-of-service attempts. After applying network policies, ensure that the `search-v2-api` pod is restarted to apply the new network rules effectively.
References
References8
- RHSA-2026:60386 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:60387 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:60388 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:60389 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:60390 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:60391 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-71469 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2512148 (opens in a new tab)issue-trackingx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-57687 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-71469)Record last updated .