EUVD-2026-61078
GHSA-3xmh-phwc-5f4g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs a joined member cluster's broker Role (PR:L) but no user interaction; MITM yields full C/I/A, and impact on other clusters makes it scope-changed (S:C).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
Articles & Coverage 2
AnalysisAI
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already possess the credentials/Role binding of a cluster joined to the Submariner broker (submariner-k8s-broker-cluster Role) - i.e., control of at least one member cluster in the mesh (PR:L); it is not exploitable by an unauthenticated external attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is internally consistent with the description: network-reachable, low complexity, requiring only the low privileges that any joined member cluster already holds, with a scope change reflecting that the blast radius extends to other clusters in the mesh. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who compromises one member cluster (or an insider operating a low-trust member cluster) uses that cluster's existing broker-cluster credentials to overwrite the gateway Endpoint records that another cluster publishes to the broker. Peer clusters then build their inter-cluster tunnels toward the attacker's gateway, letting the attacker relay, inspect, and modify traffic between services across the mesh. … |
| Remediation | No vendor-released patched version is identified in the supplied data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66780 and Bugzilla 2507524 for the errata and exact fixed build, and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat Advanced Cluster Management for Kubernetes 2 instances with multiple joined clusters and identify clusters positioned in less-trusted or internet-facing environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today