CVE-2026-66788: Use of Unmaintained Third Party Components in Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

CVE-2026-66788 is a vulnerability in the Lighthouse component of Red Hat Advanced Cluster Management for Kubernetes 2.17. It arises from the use of an attacker-controlled label or annotation on the broker object to determine the destination namespace for resource injection. This lack of validation enables a remote attacker, after compromising a spoke cluster, to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This can result in privilege escalation or other cluster compromise. The issue is linked to the use of unmaintained third-party components (CWE-1104). Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. The CVSS v3.1 score is 3.7 (low severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows an attacker who has already compromised a spoke cluster to inject unauthorized network resources into arbitrary namespaces on peer clusters, including critical system namespaces. This can lead to privilege escalation or service disruption within the cluster federation. However, the overall impact is rated low due to the high attack complexity and the requirement of prior compromise of a spoke cluster. There is no direct confidentiality or availability impact, and the integrity impact is low.

Red Hat currently does not offer a mitigation or fix that meets their product security criteria for this vulnerability. Users should monitor Red Hat advisories for updates. Since no official fix or effective mitigation is available, organizations should consider restricting access and monitoring for compromise of spoke clusters to reduce risk. Customers with a Red Hat Technical Account Manager (TAM) can review this CVE directly with their TAM for tailored guidance.