CVE-2026-66783

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes (affected versions not specified)

Description A flaw in the submariner-operator component allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.