This vulnerability in Submariner allows a malicious cluster (spoke) to redirect network traffic from other connected clusters by publishing specially crafted network endpoints. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, network traffic intended for these ranges from peer clusters is rerouted through the attacker’s tunnel, potentially causing unauthorized data interception or network disruption. The vulnerability is rated critical with a CVSS 3.1 base score of 9.9, reflecting high impact on confidentiality, integrity, and availability. Red Hat’s advisory states no current mitigation or fix meets their criteria for ease of use, applicability, or stability.

The vulnerability allows a malicious spoke cluster to hijack network traffic from peer clusters by injecting arbitrary network routes. This can lead to unauthorized disclosure of sensitive information, modification of data, and disruption of network availability within the multi-cluster Kubernetes environment managed by Red Hat Advanced Cluster Management. The CVSS score of 9.9 indicates critical impact with low attack complexity and no user interaction required.

Currently, there is no available fix or mitigation that meets Red Hat’s standards for deployment and stability. Users should monitor Red Hat’s advisory for updates. Until a fix is released, consider isolating or restricting trust relationships with spoke clusters to reduce exposure. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance on managing this vulnerability.