Skip to content
fr Sign in
5.4 Medium

CVE-2026-66781 A flaw was found in the Submariner operator

Description

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.

Affected products and versions

Product Affected versions Fixed in
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1787689013 earliest → < 1787689013 1787689013
Red Hat Advanced Cluster Management for Kubernetes 2.13 1787365971 earliest → < 1787365971 1787365971
Red Hat Advanced Cluster Management for Kubernetes 2.14 1787362756 earliest → < 1787362756 1787362756
Red Hat Advanced Cluster Management for Kubernetes 2.15 1787362733 earliest → < 1787362733 1787362733
Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670912 earliest → < 1790670912 1790670912
Red Hat Advanced Cluster Management for Kubernetes 2.17 1788073481 earliest → < 1788073481 1788073481

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Advanced Cluster Management for Kubernetes 2

The 121 CVEs of Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 High CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Medium
Track this CVE