EUVD-2026-63572
GHSA-37mq-728j-5q43
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker must be an enrolled member cluster (PR:L) reachable over the network (AV:N); unvalidated advertisement affects trusted peer clusters (S:C) allowing traffic interception, tampering, and disruption (C/I/A:H).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.
AnalysisAI
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) allows a malicious or compromised member cluster to hijack traffic from peer clusters by advertising a specially crafted network endpoint. Because Submariner does not validate the subnets a spoke cluster declares, an attacker-controlled cluster can claim arbitrary CIDR ranges and cause peer clusters to route all matching traffic through the attacker's tunnel, enabling information disclosure and denial of connectivity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be an active participant in the Submariner connectivity mesh - a malicious or compromised spoke/member cluster that is joined to the broker and able to publish network endpoints (consistent with CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) reflects a high-impact, low-complexity attack, but the PR:L requirement is critical context: the attacker must already be a participating (spoke) cluster in the Submariner mesh, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who controls or compromises one spoke cluster in a Submariner mesh publishes a crafted endpoint advertising a broad subnet (for example, the CIDR of a sensitive service network in a peer cluster). Peer cluster gateways accept the unvalidated advertisement and reroute traffic destined for that range through the attacker's tunnel, letting the attacker sniff, manipulate, or drop cross-cluster traffic. … |
| Remediation | No vendor-released patched version is identified in the provided data; consult the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-66785) and Bugzilla 2507530 (https://bugzilla.redhat.com/show_bug.cgi?id=2507530) for errata (RHSA) and apply the fixed Submariner/RHACM build once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Red Hat Advanced Cluster Management for Kubernetes 2 deployments and map cluster peer relationships to determine operational criticality and blast radius; prioritize isolation of any clusters with elevated compromise risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today