Bug 2512148 (CVE-2026-71469)

Summary: CVE-2026-71469 acm-search-v2-api-rhel9: CVE-2026-71469 search-v2-api: Unbounded tokenReviews cache allows unauthenticated memory-exhaustion DoS
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gparvin, rhaigner, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-06 19:35:13 UTC 
Cache.tokenReviews is a map[string]*tokenReviewCache keyed by the raw bearer token string (tokenReview.go:39). On every distinct token -- valid or not -- GetTokenReview inserts a new entry before the API call and never deletes it. StartBackgroundValidation watches Namespaces and ManagedClusters but has only TODO comments for token cache cleanup. An unauthenticated attacker can exhaust the search-api pod's memory by sending requests with unique random bearer tokens, each of which creates a permanent cache entry.

Upstream: stolostron/search-v2-api