Untrusted Search CR string (WORK_MEM) is concatenated into (a) a bash script line and (b) an SQL literal, with no quoting or validation. The script is mounted at /opt/app-root/src/postgresql-start/postgresql-start.sh (create_pgdeployment.go:50-52) and executed by the sclorg postgres entrypoint inside the postgres pod, which auto-mounts search-serviceaccount with cluster-wide impersonate privileges (FIND-001, FIND-010). A hub admin or Search CR editor can inject arbitrary shell commands or SQL statements executed in the context of the privileged postgres pod.

Upstream: stolostron/search-v2-operator