A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.
To mitigate this issue, restrict permissions for creating and modifying Search Custom Resources (CRs) to only trusted and authorized users. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit who can perform create, update, and patch operations on search.search.open-cluster-management.io resources. This reduces the attack surface by preventing unauthorized users from exploiting the unsanitized input flow.