https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:48:33 +0000 https://cve.radiocsirt.org/vuln/cve-2026-71467 <p><strong>Affected:</strong> Red Hat Advanced Cluster Management for Kubernetes 2.17</p> <p>A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.</p> <p><strong>Affected:</strong> Red Hat Advanced Cluster Management for Kubernetes 2.17</p> <p>A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.</p> https://cve.radiocsirt.org/vuln/cve-2026-71467