Cache.tokenReviews is a map[string]*tokenReviewCache keyed by the raw bearer token string (tokenReview.go:39). On every distinct token -- valid or not -- GetTokenReview inserts a new entry before the API call and never deletes it. StartBackgroundValidation watches Namespaces and ManagedClusters but has only TODO comments for token cache cleanup. An unauthenticated attacker can exhaust the search-api pod's memory by sending requests with unique random bearer tokens, each of which creates a permanent cache entry.

Upstream: stolostron/search-v2-api