The vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2's lighthouse component is due to insufficient verification of IP addresses advertised in EndpointSlice objects. A compromised spoke cluster can inject EndpointSlices with attacker-controlled IPs, causing lighthouse DNS in other clusters to redirect legitimate service traffic to attacker-controlled endpoints. This allows remote attackers to perform transparent MITM attacks on cross-cluster communications without altering the target service. The vulnerability is tracked as CVE-2026-66787 with a CVSS v3.1 score of 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). Red Hat has not released an official fix or mitigation that meets their standards for ease of use, applicability, and stability.

An attacker who compromises a spoke cluster can exploit this vulnerability to redirect legitimate service traffic between clusters to malicious endpoints. This enables transparent Man-in-the-Middle attacks on cross-cluster service communications, potentially resulting in unauthorized disclosure of sensitive information and manipulation of data integrity. Availability is not impacted. The attack requires high privileges on the compromised spoke cluster but no user interaction. The scope of impact extends beyond the compromised cluster due to cross-cluster DNS spoofing.

Currently, Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates. Customers with a Technical Account Manager (TAM) or Red Hat Security Select Add-on can consult directly with Red Hat for guidance. Until a fix is available, limiting the risk involves preventing compromise of spoke clusters and restricting the ability to create or modify EndpointSlice objects where possible.