EUVD-2026-61066
GHSA-4mpr-hwg7-q5x5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Cluster-level authenticated read access (PR:L, AV:L) is required; once held, exploitation is trivial with full CIA impact on the mesh network.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.
AnalysisAI
Cleartext storage of a long-lived broker service account bearer token in the Submariner Custom Resource specification exposes full mesh network control to any Kubernetes principal with CR read access. Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) is confirmed affected via CPE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated Kubernetes user with at minimum `get` permission on Submariner Custom Resources within the namespace where Submariner is deployed, OR must have direct read access to the cluster's etcd database. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score 7.8) accurately captures the attack profile: cluster-level authenticated access is required (PR:L), attack complexity is low, and no user interaction is needed once access is established. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated developer or operator with standard `kubectl get` permissions on the Submariner CR namespace issues a routine resource inspection command and observes the plaintext broker service account token embedded in the CR's `.spec` fields. The attacker then uses this token to authenticate directly to the Submariner broker API, gaining full administrative rights over the multi-cluster mesh network and enabling interception or manipulation of cross-cluster traffic and secrets. … |
| Remediation | The primary remediation is to apply the vendor-supplied patch from Red Hat once released; monitor https://access.redhat.com/security/cve/CVE-2026-66782 for errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit RBAC policies to restrict read access to Submariner Custom Resources and related secrets; document all current access holders. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today