{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-66782 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-66782 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-66782 is a medium-severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2, published on 18 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-66782 and fix it if it is affected.\n\nWhat it is: CVE-2026-66782 is a medium-severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2, published on 18 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-66782 in the wild and no public exploit code.\n\nAffected product: Red Hat Advanced Cluster Management for Kubernetes 2. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-66782/ (Markdown: https://insights.sbomify.com/CVE-2026-66782/index.md)","id":"CVE-2026-66782","markdown":"https://insights.sbomify.com/CVE-2026-66782/index.md","name":"CVE-2026-66782","record":{"aliases":["GHSA-4mpr-hwg7-q5x5"],"analysis":{"component_type":"cloud_service","fix_type":"patch","impacts":["data_read","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes operator","requires_auth":"high_privilege","summary":"Exposure of long-lived broker service account tokens in Submariner CRs allows attackers to gain full control over the mesh network.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":5.8,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"description":"A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps","id":"CVE-2026-66782","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref","id":"CVE-2026-66783"},"packages":[],"prev":{"headline":"Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication","id":"CVE-2026-66781"},"products":["Red Hat Advanced Cluster Management for Kubernetes 2","Red Hat Advanced Cluster Management for Kubernetes 2.16","Red Hat Advanced Cluster Management for Kubernetes 2.17"],"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Red Hat"]},"summary":"Exposure of long-lived broker service account tokens in Submariner CRs allows attackers to gain full control over the mesh network.","url":"https://insights.sbomify.com/CVE-2026-66782/"}