CVE-2026-66782 Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
Exposure of long-lived broker service account tokens in Submariner CRs allows attackers to gain full control over the mesh network.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66782?
CVE-2026-66782 is a medium-severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2, published on 18 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.
Weakness: CWE-269
Which versions are affected by CVE-2026-66782?
How do I fix CVE-2026-66782?
No fix has been published for CVE-2026-66782 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-66782 being exploited?
There is no known exploitation of CVE-2026-66782 in the wild and no public exploit code.
Sources
Also known as GHSA-4mpr-hwg7-q5x5.