漏洞概述 漏洞编号: Bug 2515896 (CVE-2026-76827) 漏洞标题: search-indexer: search-indexer: UPDATE/DELETE operations not scoped to caller's cluster (cross-tenant data tampering) 状态: NEW 产品: Security Response 组件: vulnerability 优先级: medium 严重性: medium 报告时间: 2026-08-19 18:59 UTC by OSIDB Botspot 修改时间: 2026-08-19 20:03 UTC (History) CC列表: 3 users (zhnn) 修复版本: Close Off 环境: Last Closed: Embargoed 影响范围 漏洞描述: Delta-sync write paths in search-indexer do not constrain UPDATE/DELETE mutations to rows owned by the authenticated cluster. UIDs are conventionally /-uid by collector convention, but the indexer never enforces this prefix. A registered managed cluster can submit a payload with a victim cluster's UID in updateResources or deleteResources and mutate/delete that cluster's indexed data, even when posting to its own /clusters//sync path. The INSERT path's ON CONFLICT (uid) DO UPDATE also overwrites an existing row's data regardless of which cluster owns it, since the cluster column is not part of the conflict target or re-checked. 具体影响: 这是一个防御性深度失败，独立于身份验证/身份绑定间隙跟踪。它需要已经合法注册、具有有效addon-framework凭据的认证管理 spoke cluster，而不是匿名或低权限调用者。 修复方案 上游Jira: AON-42544 POC代码或利用代码 页面中未包含具体的POC代码或利用代码。 其他信息 附件: 无 评论: 需要登录才能评论或对此bug进行更改。 --- 总结: 该漏洞涉及search-indexer中的UPDATE/DELETE操作未限制到调用者的集群，导致跨租户数据篡改。影响范围为已注册的托管集群，修复方案需参考上游Jira AON-42544。