EUVD-2026-70247
GHSA-f6r4-g4jr-h7f2
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attacker must control a federated cluster able to publish CRDs (PR:H); injection is network-reachable and low-complexity, root on gateway plus cross-cluster pivot gives S:C and C/I/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
AnalysisAI
Remote code execution as root on the Submariner gateway node is possible in cert-auth mode, affecting Submariner as bundled in Red Hat Advanced Cluster Management for Kubernetes 2. The gateway builds its IPsec connection configuration from unvalidated free-form CRD fields, so a malicious member cluster can publish a CableName containing embedded newlines and ipsec.conf directives (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires Submariner running in cert-auth mode and the attacker controlling a cluster that is already joined to the Submariner broker with the ability to publish Endpoint/CableName CRD values (reflected as PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity path to root with scope change, tempered by PR:H - the attacker must already control a cluster that is federated into the Submariner broker and able to publish endpoint CRDs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided data - monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-66786) and Bugzilla 2507531 for a fixed submariner-addon build and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Red Hat ACM deployments running Submariner and confirm which are in cert-auth mode; immediately implement network segmentation to restrict member cluster connectivity to gateway nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today