What is the CVSS score of CVE-2026-66780?

CVE-2026-66780 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Submariner are affected by CVE-2026-66780?

A critical, unpatched vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2's Submariner component allows a single compromised cluster member to intercept and redirect traffic across…

How to fix or mitigate CVE-2026-66780?

Within 24 hours: Inventory all Red Hat Advanced Cluster Management for Kubernetes 2 instances with multiple joined clusters and identify clusters positioned in less-trusted or internet-facing environments. Within 7 days: Implement restrictive RBAC policies on the submariner-k8s-broker-cluster Role to limit write access to endpoint records to only mandatory operations; enable comprehensive audit logging of all endpoint modifications; deploy network segmentation to restrict broker cluster access to trusted infrastructure only; and implement endpoint validation and certificate pinning on inter-cluster connections. Within 30 days: Deploy continuous monitoring and alerting for unauthorized endpoint changes and anomalous inter-cluster traffic patterns; maintain escalation procedures for emergency patch application immediately upon vendor release; conduct security assessment of all inter-cluster traffic for signs of tampering.

Submariner CVE-2026-66780

EUVD-2026-61078 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 redhat

GHSA-3xmh-phwc-5f4g

Authentication Bypass Kubernetes Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

6.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.5 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.9 CRITICAL

Attacker needs a joined member cluster's broker Role (PR:L) but no user interaction; MITM yields full C/I/A, and impact on other clusters makes it scope-changed (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Sep 01, 2026 - 20:22 NVD

CRITICAL MEDIUM

CVSS changed

Sep 01, 2026 - 20:22 NVD

9.9 (CRITICAL) 6.5 (MEDIUM)

Analysis Generated

Aug 18, 2026 - 18:03 vuln.today

CVE Published

Aug 18, 2026 - 17:32 cve.org

CRITICAL 9.9

DescriptionCVE.org

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Articles & Coverage 2

News 4 New Kubernetes Vulnerabilities - 2 Critical, 2 High Severity Aug 19, 2026 News Critical Cross-Cluster Traffic Interception in Kubernetes Submariner - CVE-2026-66780 Aug 18, 2026

AnalysisAI

Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Submariner provides encrypted network connectivity (IPsec/WireGuard tunnels) between pods and services across multiple Kubernetes/OpenShift clusters, coordinated through a central 'broker' cluster. Each participating cluster registers its gateway Endpoint objects with the broker, and other clusters read those records to establish tunnels. The root cause is CWE-284 (Improper Access Control): the RBAC Role submariner-k8s-broker-cluster, bound to all joined clusters, permits writing/overwriting Endpoint (and related) resources belonging to other clusters rather than being scoped to only that cluster's own records. The affected CPE identifies Red Hat Advanced Cluster Management for Kubernetes 2 as the shipping vehicle for the submariner-operator component.

RemediationAI

No vendor-released patched version is identified in the supplied data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66780 and Bugzilla 2507524 for the errata and exact fixed build, and apply it once published. As an immediate compensating control, tighten the submariner-k8s-broker-cluster RBAC so that each joined cluster can create and modify only its own Endpoint resources (for example via resourceNames scoping or an admission/validating webhook that rejects writes to another cluster's endpoint records) - the trade-off is added policy maintenance and the risk of blocking legitimate registration if scoping is too strict. Additionally, minimize the number of clusters sharing a single broker and segregate clusters of different trust levels onto separate brokers, and audit which clusters currently hold the broker-cluster Role, revoking any that do not require cross-cluster connectivity.