CVE-2026-76827

This vulnerability exposes a critical multi-tenancy failure in the search-indexer's delta-sync pathway. The mechanism treats authenticated cluster identity as sufficient authorization — if a cluster can authenticate, its UPDATE and DELETE operations are accepted without verifying that the target UID actually belongs to that cluster. The UID prefix pattern (different cluster prefixes) exists in the data model, but it's a naming convention, not an access control. Any authenticated cluster can craft a UID with another cluster's prefix and operate on that data directly. The CVSS 6.8 score materially understates the real risk. When search-indexer is a centralized service serving multiple tenants — which is the typical deployment — one compromised cluster doesn't just affect its own data. It poisons the shared search index that all clusters depend on. This is a hub-and-spoke failure topology: the vulnerability lives at the write path, but the blast radius extends to every tenant consuming search results from that index. An attacker who compromises a single cluster can persistently corrupt search results system-wide. For defenders: first, verify whether your deployment uses a centralized search-indexer serving multiple clusters. If so, treat this as higher severity than the CVSS suggests. Second, audit your delta-sync configuration — check whether the sync pathway validates cluster ownership before applying writes, or whether it relies solely on authenticated identity. Third, examine other sync pathways in your infrastructure for the same pattern: optimization code that trusts authenticated identity without explicit ownership verification. Fourth, review whether any cluster trust model in your system conflates authentication with authorization — the fix requires explicit cluster_id validation in every write path, not just the naming convention. The remediation isn't limited to patching the search-indexer. If downstream consumers treat delta-sync output as authoritative, you may need to audit those dependencies too. The vulnerability is the vector; the trust architecture is the systemic problem.

Reviewed through automated stages and approved by a human before publication.