Submariner Operator Role Escalation Enables Cluster Mesh MITM
CVE-2026-66780 Published on August 18, 2026

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-66780 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 22 days later.

Weakness Type

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.


Products Associated with CVE-2026-66780

Want to know whenever a new CVE is published for Red Hat Acm? stack.watch will email you.

Red Hat Acm
 

Affected Versions

Red Hat Advanced Cluster Management for Kubernetes 2.17: Red Hat Advanced Cluster Management for Kubernetes 2.17: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: