CVE-2026-66788

LowCVSS 3.7

Published: 20/08/2026(UTC)Updated: 03/09/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability in Lighthouse allows a remote attacker, after compromising a spoke cluster, to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces. This occurs because the destination namespace is derived from an attacker-controlled label or annotation on the broker object.

Risk Assessment

The risk includes privilege escalation and system compromise within the cluster, including access to sensitive resources.

Recommendation

Apply vendor patches and strengthen validation of labels and annotations on broker objects.

Other vulnerabilities in Lighthouse

CVE-2025-58902High
An unauthenticated Local File Inclusion vulnerability exists in Lighthouse versions up to 1.2.12. It allows an attacker to read arbitrary files from the server without authentication.

Original NVD description (English source)

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS