Threats Tagged 'cve-2026-66787'

Red Hat issued a security advisory for Submariner v0.23, a Kubernetes operator enabling cross-cluster connectivity for services and pods. The advisory addresses multiple security fixes and container updates in the Submariner operator and related components. The update is rated as having an Important security impact. The advisory references several CVEs affecting the product and provides updated container images and documentation improvements. No CVSS score is provided for these vulnerabilities. The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2.16. The advisory includes links to upstream Submariner release notes and Red Hat documentation for further details.

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes

CVE-2026-66787 is a vulnerability in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. It involves insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this flaw to redirect legitimate service traffic to malicious endpoints, enabling transparent Man-in-the-Middle (MITM) attacks on cross-cluster communications. This can lead to unauthorized information disclosure and data manipulation. The vulnerability has a high severity with a CVSS score of 8.7. Red Hat has addressed this issue in version 2.17 with security fixes and updated container images.