Executive brief
The search-v2-operator component in Red Hat OpenShift uses a service account with excessive permissions that allow it to impersonate any user or group within the Kubernetes cluster. If an attacker compromises a pod running under this service account, they can escalate privileges to full cluster administrator (system:masters) access, gaining complete control over the Kubernetes cluster and all workloads running on it.
Technical details
This vulnerability is a Kubernetes privilege escalation flaw caused by overly permissive RBAC (Role-Based Access Control) policies assigned to the search-serviceaccount service account in the search-v2-operator. The service account has permissions allowing impersonation of users and groups cluster-wide, including the ability to assume the system:masters role. An attacker who gains code execution in any pod running under this service account (via container escape, supply chain attack, or pod compromise) can leverage kubectl or the Kubernetes API to impersonate the cluster administrator role and execute arbitrary administrative commands, bypassing all authorization controls. The attack requires prior pod/container access but no additional network traversal.
Affected products
- Red Hat OpenShift search-v2-operator
Timeline
- 2026-08-17: disclosed