CVE-2026-66782
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw in the Submariner operator allows exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token, granting full control over the mesh network and enabling unauthorized management of network resources such as endpoints and secrets.
Risk Assessment
Token exposure can lead to full control over the mesh network, allowing an attacker to manipulate traffic and access sensitive data.
Recommendation
Restrict access to the cluster and etcd database, regularly rotate service account tokens, and apply vendor patches.
Other vulnerabilities in Submariner operator
See all- CVE-2026-66780Medium
A flaw was found in the submariner-operator component where the `submariner-k8s-broker-cluster` Role, assigned to joined clusters, has excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
- CVE-2026-66783Medium
A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path. This lack of validation enables arbitrary code execution with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Original NVD description (English source)
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS