Description
A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.11 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.13 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
References
- RHSA-2026:63016 vendor-advisory
- RHSA-2026:67538 vendor-advisory
- RHSA-2026:67539 vendor-advisory
- RHSA-2026:67540 vendor-advisory
- RHSA-2026:67541 vendor-advisory
- RHSA-2026:67542 vendor-advisory
- RHSA-2026:67543 vendor-advisory
- RHSA-2026:72880 vendor-advisory
- RHSA-2026:85227 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-66780 vdb-entry
- RHBZ#2507524 issue-tracking