CyberRota Analysis
AI-GeneratedA vulnerability in the search-indexer allows authenticated managed clusters to manipulate or delete indexed search data belonging to other clusters due to insufficient restrictions on UPDATE/DELETE operations. This could lead to unauthorized data tampering, potentially compromising the integrity of search results. Organizations utilizing managed clusters should prioritize addressing this issue to safeguard their indexed data from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.