CVE-2026-71467 Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing
Unauthenticated attackers can bypass authentication on the /federated endpoint by spoofing websocket headers, accessing sensitive federated search results.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71467?
CVE-2026-71467 is a high-severity authentication bypass vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.17, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.
Weakness: CWE-287
Which versions are affected by CVE-2026-71467?
How do I fix CVE-2026-71467?
No fix has been published for CVE-2026-71467 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-71467 being exploited?
There is no known exploitation of CVE-2026-71467 in the wild and no public exploit code.
Sources
Also known as GHSA-8x2m-938h-j94g.