CVE-2026-66782

Name of the Vulnerable Software and Affected Versions Submariner operator (affected versions not specified)

Description A flaw in the Submariner operator allows a long-lived broker service account (SA) bearer token to be exposed within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or the ability to execute kubectl get commands can obtain this token. Possession of the token grants full control over the mesh network, allowing unauthorized management of network resources, including endpoints and secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.