Log in Start free

Vulnerability · Published Aug 18, 2026 · Assigned by redhat

CVE-2026-66782Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Medium 5.8

In plain English

A medium-severity privilege mismanagement in Red Hat Advanced Cluster Management for Kubernetes 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

References