CVE-2026-66787: Active Debug Code in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

CVE-2026-66787 is a vulnerability in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes 2.17. It arises from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IPs, causing lighthouse DNS in other clusters to redirect legitimate service traffic to attacker-controlled endpoints. This enables remote attackers to perform transparent MITM attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation. Red Hat has rated this vulnerability as Important but currently states that no mitigation or fix meeting their criteria is available. The CVSS v3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L with a base score of 5.4.

The vulnerability allows a compromised spoke cluster to redirect legitimate service traffic between Kubernetes clusters to attacker-controlled IP addresses, enabling transparent Man-in-the-Middle attacks. This can result in unauthorized disclosure of information and potential data manipulation. The integrity impact is rated none, but confidentiality and availability impacts are low. The attack requires adjacency in the network and no privileges or user interaction are needed.

Red Hat currently states that mitigation for this issue is either not available or existing options do not meet their criteria for ease of use, applicability, or stability. There is no official fix or patch available at this time. Users should monitor Red Hat advisories for updates and consider consulting Red Hat Technical Account Managers if applicable. No workaround or temporary fix is provided by Red Hat.