CVE-2026-66788
Lighthouse: dockerfile build stages use end-of-life fedora 40 referenced by mutable tag
CVSS Score
3.7
EPSS Score
0.2%
EPSS Percentile
13th
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.
| CWE | CWE-1104 |
| Vendor | red hat |
| Product | red hat advanced cluster management for kubernetes 2.17 |
| Published | Aug 20, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat advanced cluster management for kubernetes 2.17
Be the first to know when new low vulnerabilities affecting red hat red hat advanced cluster management for kubernetes 2.17 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17
All versions affected Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17
All versions affected Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17
All versions affected Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.17
All versions affected