Skip to content
fr Sign in
6.5 Medium

CVE-2026-66780 A flaw was found in the submariner-operator component

Description

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1789135606 earliest → < 1789135606 1789135606
Red Hat Advanced Cluster Management for Kubernetes 2.13 1789131397 earliest → < 1789131397 1789131397
Red Hat Advanced Cluster Management for Kubernetes 2.14 1789136328 earliest → < 1789136328 1789136328
Red Hat Advanced Cluster Management for Kubernetes 2.15 1789136327 earliest → < 1789136327 1789136327
Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670912 earliest → < 1790670912 1790670912
Red Hat Advanced Cluster Management for Kubernetes 2.17 1788572527 earliest → < 1788572527 1788572527

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE