The submariner-operator component in Red Hat Advanced Cluster Management for Kubernetes 2.11 contains a critical flaw where the submariner-k8s-broker-cluster Role has overly broad permissions. This role, assigned to joined clusters, allows a compromised cluster to alter network configurations by overwriting endpoint information for all other clusters within the broker namespace. This capability enables an attacker to redirect inter-cluster tunnel traffic, facilitating a Man-in-the-Middle (MITM) attack across the cluster mesh. The vulnerability is tracked as CVE-2026-66780 with a CVSS v3.1 score of 6.5 (medium severity). Red Hat has not provided an official fix or mitigation that meets their product security criteria.

A compromised cluster can exploit this vulnerability to modify endpoint configurations of other clusters, enabling redirection of inter-cluster tunnel traffic. This allows an attacker to perform a Man-in-the-Middle (MITM) attack across the entire cluster mesh, potentially exposing sensitive data transmitted between clusters. The confidentiality impact is high, while integrity and availability impacts are not affected.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, applicability to the widespread installation base, or stability. Users should monitor Red Hat's official advisory for updates and consider limiting exposure of the submariner-k8s-broker-cluster Role where possible until an official fix is released.