Privilege Escalation in search-v2-operator via Arbitrary CR Manipulation

The search-v2-operator is susceptible to a privilege escalation vulnerability (CVE-2026-71470) that arises from insufficient validation of fields within Search Custom Resources (CRs). An attacker who already possesses the authorization to edit these CRs can inject malicious configurations into the environment. Specifically, the vulnerability allows for the modification of imageOverride, execution arguments, and environment variables. By leveraging these fields, an attacker can replace the legitimate search container with a malicious image or mount sensitive cluster secrets directly into the container's environment. The risk is significantly amplified because the ServiceAccount associated with the search operator typically maintains extensive permissions within the Kubernetes cluster, potentially enabling full cluster compromise. This issue affects deployments using the search-v2-operator and requires strict RBAC controls for CR editing access as a primary mitigation.

Impact

Successful exploitation allows for privilege escalation from a CR editor role to cluster-wide impact. By exfiltrating secrets or executing arbitrary code via container replacement, an attacker can move laterally or gain administrative control over the cluster environment.

Recommendation

• Restrict access to edit Search Custom Resources (CRs) using Kubernetes Role-Based Access Control (RBAC) to only highly trusted service accounts or users.
• Audit existing RBAC policies to identify users or service accounts with permissions to edit Search CRs.
• Apply the latest security patches provided by the vendor for the search-v2-operator to remediate the validation flaw (CVE-2026-71470).
• Implement Admission Controllers to validate the image registry and configuration of newly created or modified containers to prevent unauthorized image deployment.