Submariner CVE-2026-66786

Requires Submariner running in cert-auth mode and the attacker controlling a cluster that is already joined to the Submariner broker with the ability to publish Endpoint/CableName CRD values (reflected as PR:H). Exploitation depends on the gateway consuming attacker-influenced CRD strings and building the ipsec.conf connection config from them without sanitizing newlines or directive keywords; it is limited to deployments using cert-auth mode and to attackers who already hold a federated-cluster foothold, not arbitrary internet clients.

The CVSS 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity path to root with scope change, tempered by PR:H - the attacker must already control a cluster that is federated into the Submariner broker and able to publish endpoint CRDs. That precondition is the single most important limiter: this is not an internet-facing pre-auth bug but a trust-boundary failure where any one joined cluster can seize the gateway of the whole mesh, so it matters most in multi-tenant or partner-shared multicluster deployments. Given root-on-gateway with a scope change that pivots into peer clusters, any operator running Submariner cert-auth across clusters of differing trust levels should treat this as urgent regardless of team size. No EPSS score, KEV listing, or POC is present in the provided data, so exploitation likelihood signals are absent - the priority here rests on impact severity and the plausibility of the injection, not on evidence of in-the-wild use; verify with Red Hat's advisory whether an exploit or patched build is available.

An attacker who controls or compromises one cluster in a Submariner mesh registers an endpoint whose CableName field embeds a newline followed by an ipsec.conf leftupdown directive pointing at an attacker-supplied command. When the target cluster's gateway ingests this CRD and regenerates its IPsec configuration, the injected hook executes as root during tunnel setup, giving the attacker code execution on the gateway and, via the scope change, a pivot into the broader multicluster fabric.