Executive brief
A flaw in Red Hat's search-v2-api component allows unauthenticated attackers to send requests with random bearer tokens, causing each unique token to create a permanent cache entry that is never cleared. An attacker can exhaust the memory of the search-api pod by repeatedly sending requests with different tokens, resulting in service outages for users relying on search functionality.
Technical details
The vulnerability is an unbounded cache memory exhaustion flaw in the tokenReviews cache of search-v2-api. An unauthenticated attacker can exploit this by sending HTTP requests with unique random bearer tokens; each token is cached indefinitely without proper eviction or size limits. Since the cache grows without bound and is never cleared, repeated requests with different tokens exhaust available memory, causing the search-api pod to fail. The attack requires only network access to the search-v2-api endpoint and no authentication; exploitation results in denial of service affecting availability of search functionality.
Affected products
- Red Hat Advanced Cluster Management for Kubernetes v2.17.1 and earlier
Timeline
- 2026-08-12: disclosed
- 2026-08-26: advisory: Red Hat Security Advisory RHSA-2026:60386 published