CVE-2026-71471

Vendor solution

To mitigate this issue, restrict patch access to the Search Custom Resource (CR) to only trusted and authorized hub administrators. This limits the ability of unauthorized principals to modify the `Collector.ImageOverride` field and deploy arbitrary container images across the managed fleet.

Red Hat statement

This is an Important vulnerability in Red Hat Advanced Cluster Management for Kubernetes. A highly privileged user with patch access to the Search CR on the hub cluster can replace the collector image, leading to fleet-wide remote code execution and secret exfiltration across all managed clusters. This is due to the propagation of the `Collector.ImageOverride` field to all managed clusters.

Red Hat mitigation

To mitigate this issue, restrict patch access to the Search Custom Resource (CR) to only trusted and authorized hub administrators. This limits the ability of unauthorized principals to modify the `Collector.ImageOverride` field and deploy arbitrary container images across the managed fleet.