{"id":"CVE-2026-76827","aliases":["EUVD-2026-63091","GHSA-4vrw-8fx2-pj82"],"status":"published","title":"Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)","description":"A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00525,"percentile":0.44871,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-693"],"published":"2026-08-19T20:56:17Z","modified":"2026-10-26T10:10:00Z","products":[{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.11"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.13"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.17"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:60386","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60387","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60388","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60389","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60390","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60391","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76827","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519896","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76827"},{"url":"https://github.com/advisories/GHSA-4vrw-8fx2-pj82"}],"sources":{"cve":[{"id":"CVE-2026-76827","title":"Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)","description":"A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.","status":"published","published":"2026-08-19T20:56:17.608Z","modified":"2026-09-05T17:08:45.208Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T13:46:21.568011Z"}],"euvd":[{"id":"EUVD-2026-63091","description":"A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.","status":"published","published":"2026-08-19T20:56:17Z","modified":"2026-09-05T17:08:45Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:10.613767Z"}],"ghsa":[{"id":"GHSA-4vrw-8fx2-pj82","title":"A flaw was found in search-indexer. This vulnerability allows a registered and authenticated...","description":"A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.","status":"published","published":"2026-08-19T21:30:38Z","modified":"2026-08-27T06:31:24Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:11:02.000078Z"}],"nvd":[{"id":"CVE-2026-76827","description":"A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.","status":"published","published":"2026-08-19T21:17:39.227Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:39.962615Z"}]}}