Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2026-66780 A flaw was found in the submariner-operator component

Description

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Advanced Cluster Management for Kubernetes 2 Versions non publiées
Red Hat Advanced Cluster Management for Kubernetes 2.11 1789135606 premières → < 1789135606 1789135606
Red Hat Advanced Cluster Management for Kubernetes 2.13 1789131397 premières → < 1789131397 1789131397
Red Hat Advanced Cluster Management for Kubernetes 2.14 1789136328 premières → < 1789136328 1789136328
Red Hat Advanced Cluster Management for Kubernetes 2.15 1789136327 premières → < 1789136327 1789136327
Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670912 premières → < 1790670912 1790670912
Red Hat Advanced Cluster Management for Kubernetes 2.17 1788572527 premières → < 1788572527 1788572527

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Advanced Cluster Management for Kubernetes 2

Les 121 CVE de Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Moyenne CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 Élevée CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution 8.8 Élevée CVE-2026-93685 A flaw was found in the multicluster-observability-addon 5.4 Moyenne
Suivre cette CVE