The vulnerability CVE-2026-66783 affects the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2. It stems from improper input validation that allows an authorized user with permissions to modify the Submariner Custom Resource to specify an arbitrary, unvalidated image path. This can lead to the deployment of malicious container images with elevated privileges, enabling arbitrary code execution across all cluster nodes, including control-plane nodes. The CVSS v3.1 score is 8.2 (high severity), with an attack vector requiring local access but low complexity and no user interaction. The scope is changed, and the impact includes high confidentiality, integrity, and availability impacts. The vendor advisory emphasizes restricting cluster-admin access and controlling permissions as mitigation. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with cluster administrator privileges or equivalent permissions to modify the Submariner Custom Resource can deploy malicious container images without validation. This enables arbitrary code execution with elevated privileges across the entire Kubernetes cluster, including control-plane nodes. The impact includes full compromise of confidentiality, integrity, and availability of the cluster environment.

Currently, no official patch or fix has been confirmed by Red Hat. To mitigate this vulnerability, restrict access to cluster-admin roles and carefully control permissions for users or service accounts that can modify Submariner Custom Resources. Ensure that only trusted and authorized personnel have the ability to patch Submariner CRs to prevent injection of malicious images. Monitor Red Hat's advisory page for updates on official fixes.