What is the CVSS score of CVE-2026-66782?

CVE-2026-66782 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Submariner Operator are affected by CVE-2026-66782?

Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) stores Submariner network service credentials in plaintext within Kubernetes, exposing the multi-cluster mesh to any user or service…

How to fix or mitigate CVE-2026-66782?

Within 24 hours, audit RBAC policies to restrict read access to Submariner Custom Resources and related secrets; document all current access holders. Within 7 days, rotate all Submariner broker service account bearer tokens to invalidate any cached credentials; implement network segmentation policies restricting Submariner endpoint communication; enable etcd encryption at rest; establish audit logging on all CR and secret access. Within 30 days, monitor Red Hat advisories for patch availability and deploy immediately upon release; evaluate isolation of RHACM 2 management infrastructure from untrusted networks pending patch confirmation.

Submariner Operator CVE-2026-66782

EUVD-2026-61066 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-08-18 redhat

GHSA-4mpr-hwg7-q5x5

Authentication Bypass Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

5.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.8 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.8 HIGH

Cluster-level authenticated read access (PR:L, AV:L) is required; once held, exploitation is trivial with full CIA impact on the mesh network.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Sep 01, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Sep 01, 2026 - 20:22 NVD

7.8 (HIGH) 5.8 (MEDIUM)

Analysis Generated

Aug 18, 2026 - 17:43 vuln.today

CVE Published

Aug 18, 2026 - 17:06 nvd

HIGH 7.8

DescriptionCVE.org

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

AnalysisAI

Cleartext storage of a long-lived broker service account bearer token in the Submariner Custom Resource specification exposes full mesh network control to any Kubernetes principal with CR read access. Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) is confirmed affected via CPE. An attacker who retrieves the token - through a routine kubectl get invocation or direct etcd access - gains unrestricted authority to manage Submariner endpoints, secrets, and cross-cluster network resources, constituting a complete compromise of the multi-cluster network plane. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Submariner is a CNCF project that establishes direct pod-to-pod networking across Kubernetes clusters by maintaining a central broker component. The broker uses a dedicated Kubernetes service account whose bearer token authorizes management of cross-cluster resources. CWE-312 (Cleartext Storage of Sensitive Information) applies here: the operator embeds this long-lived token directly within the Submariner Custom Resource (CR) specification, persisting it in plaintext in Kubernetes' etcd backing store. Because etcd data is reflected through the Kubernetes API, any RBAC principal permitted to get or list the affected CR can read the token without any special privilege escalation. The affected deployment surface is specifically Red Hat Advanced Cluster Management for Kubernetes 2, as identified by CPE cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is to apply the vendor-supplied patch from Red Hat once released; monitor https://access.redhat.com/security/cve/CVE-2026-66782 for errata. No exact fixed version has been confirmed in the available data, so direct verification with Red Hat is required. As immediate compensating controls: first, audit Kubernetes RBAC policies and restrict get and list permissions on Submariner Custom Resources to only the service accounts and users that operationally require them - this directly limits who can read the exposed token. Second, rotate the broker service account token and revoke the previously exposed credential; a rotated token limits the window of exploitation for any token already exfiltrated. Third, audit etcd access controls to ensure only cluster-administrator-level principals can reach the backing store directly. These controls reduce exposure but do not eliminate the root cause of the token being stored in the CR specification.