CVE-2026-66786 Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
A malicious cluster can inject ipsec.conf directives via CRD fields to execute arbitrary commands as root on gateway nodes in cert-auth mode.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66786?
CVE-2026-66786 is a critical code injection vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2, published on 2 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
Weakness: CWE-94
Which versions are affected by CVE-2026-66786?
How do I fix CVE-2026-66786?
No fix has been published for CVE-2026-66786 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-66786 being exploited?
There is no known exploitation of CVE-2026-66786 in the wild and no public exploit code.
Sources
Also known as GHSA-f6r4-g4jr-h7f2.