EUVD-2026-63535
GHSA-264j-8377-4hmm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker must already control a spoke cluster (PR:L) but exploitation is network-reachable and low-complexity; injection into peer clusters crosses a security boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.
AnalysisAI
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already controls a spoke/participant cluster joined to the Submariner broker (reflected in CVSS PR:L), and that Submariner with the Lighthouse cross-cluster service-discovery component is deployed and actively syncing EndpointSlices/ServiceImports between clusters via the broker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high-priority issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first gains control of a single spoke cluster (via a separate compromise or a malicious/rogue participant), then sets a crafted label or annotation on the broker object so the destination namespace resolves to kube-system on a peer cluster. Submariner Lighthouse dutifully injects attacker-defined EndpointSlices and ServiceImports there, letting the attacker redirect or impersonate a system service and pivot to privilege escalation across the fleet. … |
| Remediation | No vendor-released patch version is identified in the available data, so the primary action is to monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-66788) and Bugzilla 2507533 (https://bugzilla.redhat.com/show_bug.cgi?id=2507533) and apply the fixed ACM 2 / Submariner errata as soon as it is published, citing the exact errata version from that advisory rather than an assumed number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Red Hat Advanced Cluster Management for Kubernetes 2 deployments using Submariner, document current component versions and cluster interconnections, and audit which namespaces are exposed to broker cluster access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription compon
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) a
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Same weakness CWE-284 – Improper Access Control
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today