EUVD-2026-61067
GHSA-95w2-696m-24mq
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
AV:L reflects Kubernetes cluster-API-local access requirement; PR:H reflects cluster-admin or Submariner CR write privilege; S:C captures cross-node cluster-wide scope change including control-plane.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Articles & Coverage 1
AnalysisAI
Remote code execution in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.x allows a cluster administrator-or any user holding RBAC permissions to modify the Submariner Custom Resource-to reference an unvalidated, attacker-controlled container image path, causing the operator to deploy and execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes. The root cause (CWE-20: Improper Input Validation) is the absence of image path sanitization or verification before the operator acts on the Submariner CR field, enabling privilege escalation beyond the user's intended cluster boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Submariner operator component is installed and actively running as part of Red Hat Advanced Cluster Management for Kubernetes 2.x - RHACM deployments without Submariner configured are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C reflects a local, high-privilege attack path with Changed Scope - the attacker must already hold cluster-admin rights or an equivalent RBAC role granting Submariner CR write access, which is a significant prerequisite that substantially constrains the threat surface in well-governed environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor with cluster-administrator privileges or explicit RBAC rights to modify Submariner Custom Resources edits the Submariner CR to replace the operator's image field with a reference to a malicious container image hosted on an attacker-controlled registry. The submariner-operator, lacking image path validation, pulls and deploys the malicious image as a privileged workload across cluster nodes - including control-plane nodes - executing attacker-controlled code with elevated permissions and enabling full cluster takeover. … |
| Remediation | Monitor the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-66783 and the Bugzilla ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2507528 for an official patched release and apply it as soon as the vendor publishes a fixed version - specific patched version numbers were not confirmed in available intelligence at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Red Hat Advanced Cluster Management 2.x deployments running Submariner and identify users and service accounts with RBAC permissions to modify Submariner Custom Resources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today