4.4
Moyenne
CVE-2026-66783 A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes
Description
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions non publiées | |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 1788073481 | premières → < 1788073481 | 1788073481 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670912 | premières → < 1790670912 | 1790670912 |
Références
- RHSA-2026:63016 access.redhat.com
- RHSA-2026:85227 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2507528 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Advanced Cluster Management for Kubernetes 2
Les 121 CVE de Red Hat Advanced Cluster Management for Kubernetes 2 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
Élevée
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
Élevée
CVE-2026-93685
A flaw was found in the multicluster-observability-addon
5.4
Moyenne