CVE-2026-66786

CriticalCVSS 9.1/10Last modified Oct 19, 2026

Description

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—

References

Timeline

Published: Sep 2, 2026
Last modified: Oct 19, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-667878.7A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficie CVE-2026-667889.9A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namesp CVE-2026-66797.5A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow w CVE-2026-667929.9A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their CVE-2026-667938.8A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with perm CVE-2026-667949.3A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated CVE-2026-667959.9A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates inc CVE-2026-667975.4Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation CVE-2026-667984.3Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-667997.8Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.CVE-2026-668007.5Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-668019.8Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.