CVE-2026-66786: Improper Control of Generation of Code ('Code Injection') in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

This vulnerability arises from improper validation of user-supplied configuration strings in Submariner's certificate-based IPsec authentication mode within Red Hat Advanced Cluster Management for Kubernetes 2.17. Specifically, the CableName field in the CRD can contain newlines and ipsec.conf directives that are not sanitized, enabling an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks. This leads to remote code execution with root privileges on the gateway node. The attack requires that the attacker already has cluster-admin access to a managed spoke cluster and can submit malicious Endpoint resources to the broker API, enabling lateral movement within the same ManagedClusterSet. The vulnerability does not affect the default PSK authentication mode, which uses a different code path not susceptible to this injection.

Successful exploitation results in remote code execution as root on the gateway node, compromising confidentiality, integrity, and availability of the affected cluster. It enables an attacker with prior cluster-admin access on a managed spoke cluster to perform lateral movement to other clusters within the same ManagedClusterSet. However, exploitation requires enabling two non-default configurations (certificate-based IPsec authentication mode and integration with OVN-Kubernetes IPsec) and prior compromise of a spoke cluster, limiting the attack surface.

Red Hat advises administrators to disable the certificate-based IPsec authentication mode by setting 'IPSecCertAuthMode: false' or removing this field in the SubmarinerConfig Custom Resource and redeploying the Submariner gateway pods. Switching to the default pre-shared key (PSK) authentication mode mitigates this vulnerability as it uses a different, unaffected code path. No other action is required if cert-auth mode is not enabled. Administrators should verify their Submariner configuration and ensure cert-auth mode is disabled unless explicitly needed.