RedHat AMK Lighthouse IP validation flaw enabling MITM
CVE-2026-66787 Published on August 20, 2026
Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 24 days later.
Weakness Type
Active Debug Code
The application is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information. A common development practice is to add "back door" code specifically designed for debugging or testing purposes that is not intended to be shipped or deployed with the application. These back door entry points create security risks because they are not considered during design or testing and fall outside of the expected operating conditions of the application.
Products Associated with CVE-2026-66787
Want to know whenever a new CVE is published for Red Hat Acm? stack.watch will email you.
Affected Versions
Red Hat Advanced Cluster Management for Kubernetes 2.17:- Version 1788023916 and below * is unaffected.
- Version 1788023940 and below * is unaffected.
- Version 1788105072 and below * is unaffected.
- Version 1788073481 and below * is unaffected.