A flaw was found in the submariner-operator component. (CVE-2026-66780)

The submariner-operator component contains a privilege misconfiguration in the `submariner-k8s-broker-cluster` Role, which is granted to joined clusters. This role has excessive permissions that permit a compromised cluster to alter network configurations by overwriting endpoint information of other clusters. This vulnerability enables an attacker to redirect inter-cluster tunnel traffic, facilitating a Man-in-the-Middle attack across the entire cluster mesh. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker who compromises a joined cluster can manipulate network configurations to redirect traffic between clusters, enabling interception and potential modification of inter-cluster communications. This can lead to a full Man-in-the-Middle attack affecting the confidentiality, integrity, and availability of data across the cluster mesh.

Red Hat has issued a security advisory (RHSA-2026:60386) addressing this vulnerability in Red Hat Advanced Cluster Management for Kubernetes. Users should apply the security update to version 2.17.1 or later, which includes the fix. Before applying this update, ensure all previously released relevant errata are applied. Refer to Red Hat's official guidance for update procedures. No additional mitigation steps are required beyond applying the official fix.