← CVE Intelligence

CVE-2026-66780

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity PUBLISHED

Description (CNA)

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11unaffected 1789135606 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13unaffected 1789131397 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14unaffected 1789136328 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.15unaffected 1789136327 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1789136320 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1787854416 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1790670243 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1790670912 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1788105072 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1788073481 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1788572527 before *
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2affected

CWE

CWE-532

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.