Search-V2-Operator - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/search-v2-operator/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 19 Aug 2026 18:38:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in search-v2-operator via Arbitrary CR Manipulationhttps://feed.craftedsignal.io/briefs/2026-08-search-v2-operator-vulnerability/Wed, 19 Aug 2026 18:38:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-search-v2-operator-vulnerability/A vulnerability in the search-v2-operator allows a privileged user to manipulate Custom Resource fields, leading to secret exfiltration and container image replacement.The search-v2-operator is susceptible to a privilege escalation vulnerability (CVE-2026-71470) that arises from insufficient validation of fields within Search Custom Resources (CRs). An attacker who already possesses the authorization to edit these CRs can inject malicious configurations into the environment. Specifically, the vulnerability allows for the modification of imageOverride, execution arguments, and environment variables. By leveraging these fields, an attacker can replace the legitimate search container with a malicious image or mount sensitive cluster secrets directly into the container's environment. The risk is significantly amplified because the ServiceAccount associated with the search operator typically maintains extensive permissions within the Kubernetes cluster, potentially enabling full cluster compromise. This issue affects deployments using the search-v2-operator and requires strict RBAC controls for CR editing access as a primary mitigation.

Impact

Successful exploitation allows for privilege escalation from a CR editor role to cluster-wide impact. By exfiltrating secrets or executing arbitrary code via container replacement, an attacker can move laterally or gain administrative control over the cluster environment.

Recommendation

  • Restrict access to edit Search Custom Resources (CRs) using Kubernetes Role-Based Access Control (RBAC) to only highly trusted service accounts or users.
  • Audit existing RBAC policies to identify users or service accounts with permissions to edit Search CRs.
  • Apply the latest security patches provided by the vendor for the search-v2-operator to remediate the validation flaw (CVE-2026-71470).
  • Implement Admission Controllers to validate the image registry and configuration of newly created or modified containers to prevent unauthorized image deployment.
]]>highadvisoryprivilege-escalationcloud-securitykubernetes