CVE-2026-66780

Name of the Vulnerable Software and Affected Versions submariner-operator (affected versions not specified)

Description A flaw in the submariner-operator component involves the submariner-k8s-broker-cluster Role assigned to joined clusters, which possesses excessive permissions. This allows a compromised cluster to modify network configurations by overwriting endpoint information of other clusters. This can lead to the redirection of inter-cluster tunnel traffic, facilitating a Man-in-the-Middle (MITM) attack—where an attacker intercepts and potentially alters communication—across the entire cluster mesh.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.