CVE-2026-66787

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes (affected versions not specified)

Description A flaw in the lighthouse component occurs due to insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can create EndpointSlices with attacker-controlled IP addresses, causing the lighthouse DNS of other clusters to redirect legitimate service traffic to malicious endpoints. This allows a remote attacker to perform transparent Man-in-the-Middle (MITM) attacks—a technique where an attacker secretly relays and possibly alters the communications between two parties—on cross-cluster service communications, which may result in unauthorized data manipulation and information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.