What is the CVSS score of EUVD-2026-61065?

EUVD-2026-61065 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Submariner Operator EUVD-2026-61065

| CVE-2026-66781 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-08-18 redhat

GHSA-gcch-g8g2-6852

Information Disclosure Kubernetes Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

5.4

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

5.4 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

vuln.today AI

6.5 MEDIUM

PR:L confirmed by CR read-access requirement; S:C reflects mesh-wide PSK compromise; I:N/A:N as this enables only passive decryption.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Sep 01, 2026 - 20:22 NVD

6.5 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Aug 18, 2026 - 17:45 vuln.today

DescriptionCVE.org

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.

AnalysisAI

Cleartext storage of the IPsec pre-shared key (PSK) in the Submariner Custom Resource exposes the cryptographic secret used to secure all inter-cluster communication in Red Hat Advanced Cluster Management for Kubernetes 2 deployments. Any principal with low-privilege read access to the Submariner CR object within the Kubernetes cluster can retrieve the PSK and use it to passively decrypt IPsec-encrypted traffic flowing between every cluster in the connected mesh - not just the cluster where access was obtained (CVSS scope change S:C). No public exploit code exists and the vulnerability is not listed in CISA KEV, but the architectural impact is severe: a single stolen key compromises the confidentiality of all inter-cluster traffic simultaneously.

Technical ContextAI

Submariner is the open-source multi-cluster networking component embedded in Red Hat Advanced Cluster Management for Kubernetes 2 (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*). It establishes IPsec tunnels between Kubernetes clusters using a pre-shared key for authentication and encryption. The PSK is provisioned through the Submariner Custom Resource (CR), a Kubernetes API object managed by the Submariner operator. The root cause is CWE-312 (Cleartext Storage of Sensitive Information): the CR persists the PSK in unencrypted plaintext within Kubernetes etcd, making it readable to any entity with GET/LIST rights on the Submariner CR object - a permission level attainable by many service accounts and developers in typical RBAC configurations. The CVSS scope change (S:C) reflects that the compromised element (the PSK on one cluster) grants decryption capability over traffic on all connected clusters.

RemediationAI

No specific patched version number is identified in the available data - the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66781 and Bugzilla issue https://bugzilla.redhat.com/show_bug.cgi?id=2507526 should be consulted directly for the current patch status and target fix version. Patch available per vendor advisory once released. As an immediate compensating control, restrict Kubernetes RBAC permissions on the Submariner CR to the minimum required set of service accounts and human users; removing GET/LIST/WATCH rights from non-operator principals prevents unauthorized PSK retrieval without disrupting tunnel operation. Additionally, rotate the IPsec PSK immediately if there is any suspicion of unauthorized access to the CR; rotating the key terminates decryption capability from any previously captured traffic. Network-level mitigations such as restricting inter-cluster traffic to dedicated infrastructure VLANs or VPNs with separate authentication can reduce the value of the captured PSK but do not fix the root-cause storage flaw.