CVE-2026-66785
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in Submariner allows a malicious cluster (spoke) to redirect network traffic from other connected clusters by publishing a specially crafted network endpoint. The system fails to properly validate network subnets, enabling the malicious cluster to declare arbitrary network ranges.
Risk Assessment
The risk includes unauthorized information disclosure or network disruption, as traffic from peer clusters may be rerouted through the attacker's tunnel.
Recommendation
Apply vendor patches and strengthen subnet validation in Submariner configuration.
Other vulnerabilities in Submariner
See all- CVE-2026-66786Critical
In Submariner's cert-auth mode, connection configuration is built from unvalidated free-form strings from the CRD. A malicious cluster can publish a CableName with newlines and ipsec.conf directives, allowing injection of arbitrary configuration or command execution via leftupdown hooks, leading to remote code execution as root on the gateway node.
- CVE-2026-66781Medium
A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.
- CVE-2024-5042Medium
A flaw in the Submariner project involves unnecessary RBAC permissions. A privileged attacker can run a malicious container on a node, steal service account tokens, and compromise other nodes or the entire cluster.
Original NVD description (English source)
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS