CVE-2026-66785: Incorrect Permission Assignment for Critical Resource in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

This vulnerability in Submariner, a component of Red Hat Advanced Cluster Management for Kubernetes 2.17, allows a malicious spoke cluster to inject arbitrary network routes by publishing crafted network endpoints. The system fails to validate the network subnets provided by the malicious cluster, enabling traffic intended for those ranges from peer clusters to be rerouted through the attacker’s tunnel. This can result in unauthorized data interception or network disruption within a multi-cluster Kubernetes environment. The vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). Red Hat has rated this issue as Important but currently does not provide a fix or mitigation that meets their criteria for ease of use, applicability, or stability. The CVSS v3.1 base score is 2.5, reflecting low confidentiality impact, no integrity or availability impact, local attack vector, high attack complexity, and low privileges required.

The vulnerability allows a malicious cluster with local access to redirect network traffic from other connected clusters by injecting arbitrary network routes. This can lead to unauthorized disclosure of information or network disruption within the multi-cluster environment. The impact is limited to confidentiality with no integrity or availability impact. The attack complexity is high, and user interaction is not required.

Currently, there is no available fix or mitigation that meets Red Hat’s criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. Customers with a Technical Account Manager (TAM) can review this CVE directly with their TAM for tailored guidance. Upgrading to a supported product version that includes a fix, once available, is recommended.