CVE-2026-66783
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path. This lack of validation enables arbitrary code execution with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Risk Assessment
An attacker can gain full control over the Kubernetes cluster, compromising integrity, confidentiality, and availability of all resources.
Recommendation
Restrict permissions to modify Submariner CR to trusted administrators only and apply updates provided by Red Hat.
Other vulnerabilities in submariner-operator
See all- CVE-2026-66780Medium
A flaw was found in the submariner-operator component where the `submariner-k8s-broker-cluster` Role, assigned to joined clusters, has excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
- CVE-2026-66782Medium
A flaw in the Submariner operator allows exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token, granting full control over the mesh network and enabling unauthorized management of network resources such as endpoints and secrets.
Original NVD description (English source)
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS