A 9.9-rated flaw in Red Hat's Kubernetes management tool isn't as apocalyptic as the score implies

A newly disclosed flaw in a component of Red Hat’s Kubernetes cluster management software has been handed a headline-grabbing CVSS score of 9.9 out of 10, putting it firmly in “critical” territory on paper. Look past the number, though, and this is a fairly ordinary case of a piece of software being given far more power than it needs — not evidence of anyone actively breaking into clusters right now.

What the bug actually does

The issue, tracked as CVE-2026-70496, sits inside something called search-v2-operator, a component bundled with Red Hat Advanced Cluster Management for Kubernetes (RHACM). According to the official description, the operator’s ClusterRole — essentially its permission slip inside a Kubernetes cluster — is configured with privileges “equivalent to a cluster administrator”. That’s a big deal in Kubernetes terms: cluster-admin is the top rung, capable of doing more or less anything.

Specifically, the operator can impersonate other users or services, rewrite Role-Based Access Control (RBAC) rules, approve Certificate Signing Requests, and manage ManifestWork objects used to push configuration out to connected clusters. None of that is what a search operator should ever need to do. The formal classification is CWE-250, “Execution with Unnecessary Privileges” — a fancy way of saying the software was over-trusted by design, not that it contains some clever exploit chain.

Critical score, but a quieter reality

Here’s the catch worth flagging: the 9.9 figure comes from a CVSS 3.1 vector supplied by Red Hat as the CVE’s assigning authority, and it assumes a “changed scope” attack with no privileges or user interaction required — the kind of maths that produces near-maximum scores. Yet Red Hat’s own advisory rates the real-world severity as “Important” rather than Critical, its own internal scale sitting one notch below the top. That’s a meaningful gap between the raw CVSS number and how Red Hat itself is actually treating the problem, and it’s the sort of discrepancy worth watching for rather than taking a single score at face value.

Red Hat’s statement also notes that exploitation “requires an att—” before the source text is cut off, so the exact preconditions for an attacker to actually abuse this excessive access aren’t fully spelled out in what’s public so far. There is no indication in the available material that this flaw is being exploited in the wild, and no confirmed patch version or fix timeline is given in the sources reviewed.

So who is actually at risk

This affects organisations running Red Hat Advanced Cluster Management for Kubernetes — a product used by IT teams to oversee fleets of Kubernetes clusters, typically in large enterprises, government bodies and cloud-native shops. It has nothing to do with home PCs, phones, browsers or consumer software. If you don’t run OpenShift or RHACM infrastructure, this bug simply isn’t relevant to you.

What to do about it

For the cluster administrators who are affected, the sensible move is to check Red Hat’s advisory and the associated Bugzilla tracker for an update fixing the ClusterRole’s permissions, and to keep an eye on whether Red Hat ships a patched operator version. Everyone else can safely file this under “interesting, not urgent” — a reminder that big CVSS numbers describe theoretical worst cases, not confirmed real-world danger.