Cluster compromise via unsanitized Search CR overrides

Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes allows remote authenticated users to compromise the cluster via Search CR edits. The search-v2-operator reconciles user-controlled Search custom resource fields such as imageOverride, arguments, and environment variables into pod specifications without validating or restricting them, allowing a CR editor to mount arbitrary secrets into the container environment or replace the container image with an attacker-controlled one. Exploitation requires permission to edit the Search custom resource on the hub cluster, but the resulting pod runs with a service account that has broad impersonation rights, so successful abuse can escalate to full cluster compromise.