CVE-2026-66782
Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
CVSS Score
5.8
EPSS Score
0.2%
EPSS Percentile
13th
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.
| CWE | CWE-269 |
| Vendor | red hat |
| Product | red hat advanced cluster management for kubernetes 2.17 |
| Published | Aug 18, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat advanced cluster management for kubernetes 2.17
Be the first to know when new medium vulnerabilities affecting red hat red hat advanced cluster management for kubernetes 2.17 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17
All versions affected Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17
All versions affected Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2
All versions affected Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2
All versions affected