Bug 2512146 (CVE-2026-71467)

Summary: CVE-2026-71467 acm-search-v2-api-rhel9: CVE-2026-71467 search-v2-api: Authentication bypass on /federated via Upgrade: websocket header spoofing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gparvin, rhaigner, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-06 19:34:54 UTC 
The authentication middleware in search-v2-api unconditionally skips authentication when the request carries an `Upgrade: websocket` header (pkg/rbac/authnMiddleware.go:21). The /federated subrouter applies only AuthenticateUser before HandleFederatedRequest, which is a plain JSON handler that never validates the WebSocket handshake, never re-checks the token, and never consults GetUserData. An unauthenticated attacker can send a standard HTTP POST to /federated with `Upgrade: websocket` to bypass authentication and query federated search results across all configured remote managed hubs.

Precondition: FEATURE_FEDERATED_SEARCH=true (default off; enabled for Global Hub deployments).

Upstream: stolostron/search-v2-api