CVE-2026-76827CWE-693

CVE-2026-76827

Medium · published August 20, 2026

CVSS v3.1
6.8
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.7th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-08-20T01:17Z
References (8)
https://access.redhat.com/errata/RHSA-2026:60386 · [email protected]https://access.redhat.com/errata/RHSA-2026:60387 · [email protected]https://access.redhat.com/errata/RHSA-2026:60388 · [email protected]https://access.redhat.com/errata/RHSA-2026:60389 · [email protected]https://access.redhat.com/errata/RHSA-2026:60390 · [email protected]https://access.redhat.com/errata/RHSA-2026:60391 · [email protected]https://access.redhat.com/security/cve/CVE-2026-76827 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2519896 · [email protected]
EPSS history
Timeline
  • 19 AUG 20:56Z
    Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)
    cvelistv5