Bug 2512146 (CVE-2026-71467) - CVE-2026-71467 acm-search-v2-api-rhel9: CVE-2026-71467 search-v2-api: Authentication bypass on /federated via Upgrade: websocket header spoofing
Summary: CVE-2026-71467 acm-search-v2-api-rhel9: CVE-2026-71467 search-v2-api: Authent...
Keywords:
Status: NEW
Alias: CVE-2026-71467
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-06 19:34 UTC by OSIDB Bzimport
Modified: 2026-08-11 18:25 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-06 19:34:54 UTC 
The authentication middleware in search-v2-api unconditionally skips authentication when the request carries an `Upgrade: websocket` header (pkg/rbac/authnMiddleware.go:21). The /federated subrouter applies only AuthenticateUser before HandleFederatedRequest, which is a plain JSON handler that never validates the WebSocket handshake, never re-checks the token, and never consults GetUserData. An unauthenticated attacker can send a standard HTTP POST to /federated with `Upgrade: websocket` to bypass authentication and query federated search results across all configured remote managed hubs.

Precondition: FEATURE_FEDERATED_SEARCH=true (default off; enabled for Global Hub deployments).

Upstream: stolostron/search-v2-api
Note You need to log in before you can comment on or make changes to this bug.