CVE-2026-66781: Cleartext Storage of Sensitive Information in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
A vulnerability in the Submariner operator of Red Hat Advanced Cluster Management for Kubernetes 2 exposes the IPsec pre-shared key (PSK) in cleartext within the Submariner Custom Resource (CR). This key is critical for securing communication between Kubernetes clusters. Because the PSK is stored unencrypted and is identical across clusters in a mesh, an attacker with appropriate permissions can access it and passively decrypt network traffic between clusters, leading to sensitive information disclosure.
AI Analysis
Technical Summary
The Submariner operator's Custom Resource (CR) stores the IPsec pre-shared key (PSK) in an unencrypted format. Since Kubernetes Custom Resources are not encrypted by default in etcd on OpenShift, and the PSK is the same across all clusters in a mesh, unauthorized parties with access to the CR can retrieve the PSK. This enables passive decryption of network traffic between any two connected clusters in the mesh, resulting in confidentiality compromise. The vulnerability requires local access with low privileges and no user interaction, with a CVSS 3.1 score of 6.5. The vendor advisory emphasizes implementing strict Kubernetes Role-Based Access Control (RBAC) to restrict access to the Submariner CRs and cautions about exposure through diagnostic data and GitOps repositories. No official patch or fix is currently indicated in the advisory.
Potential Impact
An attacker with appropriate Kubernetes permissions can read the IPsec pre-shared key stored in cleartext, allowing passive decryption of network traffic between clusters. This results in high confidentiality impact due to sensitive information disclosure. There is no impact on integrity or availability. The vulnerability requires local access with low privileges and no user interaction.
Mitigation Recommendations
No official patch or fix is currently available. To mitigate the risk, implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit access to Submariner Custom Resources. Ensure only authorized administrators and systems can view the 'submariner' Custom Resources. Exercise caution when collecting and storing diagnostic data such as must-gather bundles and when managing GitOps repositories, as these may inadvertently expose the cleartext PSK.
CVE-2026-66781: Cleartext Storage of Sensitive Information in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Description
A vulnerability in the Submariner operator of Red Hat Advanced Cluster Management for Kubernetes 2 exposes the IPsec pre-shared key (PSK) in cleartext within the Submariner Custom Resource (CR). This key is critical for securing communication between Kubernetes clusters. Because the PSK is stored unencrypted and is identical across clusters in a mesh, an attacker with appropriate permissions can access it and passively decrypt network traffic between clusters, leading to sensitive information disclosure.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Submariner operator's Custom Resource (CR) stores the IPsec pre-shared key (PSK) in an unencrypted format. Since Kubernetes Custom Resources are not encrypted by default in etcd on OpenShift, and the PSK is the same across all clusters in a mesh, unauthorized parties with access to the CR can retrieve the PSK. This enables passive decryption of network traffic between any two connected clusters in the mesh, resulting in confidentiality compromise. The vulnerability requires local access with low privileges and no user interaction, with a CVSS 3.1 score of 6.5. The vendor advisory emphasizes implementing strict Kubernetes Role-Based Access Control (RBAC) to restrict access to the Submariner CRs and cautions about exposure through diagnostic data and GitOps repositories. No official patch or fix is currently indicated in the advisory.
Potential Impact
An attacker with appropriate Kubernetes permissions can read the IPsec pre-shared key stored in cleartext, allowing passive decryption of network traffic between clusters. This results in high confidentiality impact due to sensitive information disclosure. There is no impact on integrity or availability. The vulnerability requires local access with low privileges and no user interaction.
Mitigation Recommendations
No official patch or fix is currently available. To mitigate the risk, implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit access to Submariner Custom Resources. Ensure only authorized administrators and systems can view the 'submariner' Custom Resources. Exercise caution when collecting and storing diagnostic data such as must-gather bundles and when managing GitOps repositories, as these may inadvertently expose the cleartext PSK.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-27T17:51:24.885Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-66781","vendor":"Red Hat"}]
Threat ID: 6a849468c6e8be03328570e6
Added to database: 08/18/2026, 17:20:40 UTC
Last enriched: 08/18/2026, 17:35:54 UTC
Last updated: 08/18/2026, 17:35:54 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.