2512147 – (CVE-2026-71468) CVE-2026-71468 acm-search-v2-api-rhel9: CVE-2026-71468 search-v2-api: Cross-user bearer-token reuse via global federation-config cache

Bug 2512147 (CVE-2026-71468) - CVE-2026-71468 acm-search-v2-api-rhel9: CVE-2026-71468 search-v2-api: Cross-user bearer-token reuse via global federation-config cache

Summary: CVE-2026-71468 acm-search-v2-api-rhel9: CVE-2026-71468 search-v2-api: Cross-u...

Keywords:
Status:	NEW
Alias:	CVE-2026-71468
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2026-08-06 19:35 UTC by OSIDB Bzimport
Modified:	2026-08-11 18:18 UTC (History)
CC List:	3 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description OSIDB Bzimport 2026-08-06 19:35:04 UTC

cachedFedConfig is a package-level singleton with no per-user keying (fedConfig.go:35). When getFederationConfig refreshes the cache, it captures the current request's bearer token and reuses it for all subsequent federated requests until the cache TTL expires. This means the first user to trigger a cache miss after TTL expiry donates their token to all subsequent federated queries by other users, enabling cross-user data access to remote managed hub search results.

Precondition: FEATURE_FEDERATED_SEARCH=true (default off; enabled for Global Hub deployments) and at least one remote managed hub configured with a search-global ManagedServiceAccount Secret.

Upstream: stolostron/search-v2-api

Note You need to log in before you can comment on or make changes to this bug.