Skip to content
Fencer Vulns
medium 5.8

CVE-2026-66782 json

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

published 2026-08-18 2 mo ago modified 2026-10-19 20 d ago also EUVD-2026-61066

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

Patch / fix

  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670243, 1790670912
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 1788073481, 1788105072

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-66782 updated cvss 5.8

submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-addon-rhel9, rhacm2/submariner-operator-bundle
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/subctl-rhel9 1790670243, rhacm2/submariner-rhel9-operator 1790670912
    fixed: vendor fix RHSA-2026:85227
  • Red Hat Advanced Cluster Management for Kubernetes 2.17 rhacm2/subctl-rhel9 1788105072, rhacm2/submariner-rhel9-operator 1788073481
    fixed: vendor fix RHSA-2026:63016
  • Red Hat Advanced Cluster Management for Kubernetes 2.16 rhacm2/nettest-rhel9 1790702141, rhacm2/lighthouse-agent-rhel9 1790670439, rhacm2/lighthouse-coredns-rhel9 1790670231, rhacm2/submariner-gateway-rhel9 1790670508, rhacm2/submariner-globalnet-rhel9 1790670233, rhacm2/submariner-operator-bundle 1790750775, +1 more Red Hat Advanced Cluster Management for Kubernetes 2.17 rhacm2/nettest-rhel9 1788166791, rhacm2/lighthouse-agent-rhel9 1788023916, rhacm2/lighthouse-coredns-rhel9 1788023940, rhacm2/submariner-gateway-rhel9 1788043964, rhacm2/submariner-globalnet-rhel9 1788043961, rhacm2/submariner-operator-bundle 1788217593, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Affected products

  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.