CVE-2026-66780
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A flaw was found in the submariner-operator component where the `submariner-k8s-broker-cluster` Role, assigned to joined clusters, has excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
Risk Assessment
Risk of taking control over inter-cluster network traffic, potentially leading to eavesdropping, data modification, or disruption of the entire cluster mesh.
Recommendation
Immediately restrict the permissions of the `submariner-k8s-broker-cluster` role and apply patches provided by the submariner-operator vendor.
Other vulnerabilities in submariner-operator
See all- CVE-2026-66783Medium
A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path. This lack of validation enables arbitrary code execution with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
- CVE-2026-66782Medium
A flaw in the Submariner operator allows exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token, granting full control over the mesh network and enabling unauthorized management of network resources such as endpoints and secrets.
Original NVD description (English source)
A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS