Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Red Hat Linux

High [CVE-2026-71469] Unbounded tokenReviews cache allows unauthenticated memory-exhaustion DoS

This high-severity Red Hat Linux advisory covers CVE-2026-71469 affecting Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Management for Kubernetes 2.14.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-71469 Source published Source updated

VulniPulse record published Record updated

CVE-2026-71469
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens.

Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This risk is heightened by the component's exposure to unauthenticated requests.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.

Affected Red Hat products: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.

Red Hat fixing advisory: RHSA-2026:60387, RHSA-2026:60390, RHSA-2026:60388, RHSA-2026:60389, RHSA-2026:60391, RHSA-2026:60386.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 28 days ago·verify at source

Fixed versions
  • rhacm2/acm-search-v2-api-rhel9:1787689524
  • rhacm2/acm-search-v2-api-rhel9:1787263804
  • rhacm2/acm-search-v2-api-rhel9:1786723845
  • rhacm2/acm-search-v2-api-rhel9:1787238618
  • rhacm2/acm-search-v2-api-rhel9:1787191668
  • rhacm2/acm-search-v2-api-rhel9:1787229541
  • RHSA-2026:60387
  • RHSA-2026:60390
  • RHSA-2026:60388
  • RHSA-2026:60389
  • RHSA-2026:60391
  • RHSA-2026:60386

Official advisory · high-confidence parse· fetched 28 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • To mitigate this issue, restrict network access to the `search-v2-api` component within Red Hat Advanced Cluster Management for Kubernetes. Implement network policies to limit incoming connections to only trusted sources that require access to the search API. This will reduce the attack surface for unauthenticated denial-of-service attempts. After applying network policies, ensure that the `search-v2-api` pod is restarted to apply the new network rules effectively.

Official advisory · high-confidence parse· fetched 28 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.