CVE-2026-66788

Name of the Vulnerable Software and Affected Versions Lighthouse (affected versions not specified)

Description A flaw allows a remote attacker who has compromised a spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters. This occurs because the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This issue can affect critical system namespaces such as kube-system and openshift-*, potentially leading to privilege escalation or full system compromise within the cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.