The Submariner operator's Custom Resource (CR) stores the IPsec pre-shared key (PSK) in an unencrypted format. Because Kubernetes Custom Resources are not encrypted by default in etcd on OpenShift, and the PSK is shared across all clusters in the mesh, an attacker with appropriate permissions to view the Submariner CR can retrieve the PSK. This enables passive decryption of network traffic between any two clusters connected by Submariner. The vulnerability does not require privileges beyond read access to the CR and does not require user interaction. The impact is limited to confidentiality loss of network traffic and low availability impact. Red Hat has assigned a CVSS score of 5.4 and classifies the issue as Important.

Unauthorized parties with read access to the Submariner Custom Resource can obtain the IPsec pre-shared key in cleartext. This allows passive decryption of network traffic between Kubernetes clusters in the mesh, resulting in sensitive information disclosure. The vulnerability does not allow modification of data or disruption of service beyond low availability impact. No known exploits are reported in the wild.

Red Hat recommends implementing strict Kubernetes Role-Based Access Control (RBAC) policies to restrict access to Submariner Custom Resources, ensuring only authorized administrators and systems can view these resources. Caution should be exercised when collecting and storing diagnostic data such as must-gather bundles or managing GitOps repositories, as these may inadvertently expose the cleartext PSK. No official patch or fix is explicitly stated in the advisory; therefore, patch status is not yet confirmed — check the Red Hat advisory for updates. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required.