A critical (CVSS 9.1) code injection flaw in Submariner lets a malicious cluster inject arbitrary IPsec configuration through an unvalidated CableName field, resulting in remote code execution as root on the gateway node.
What Is It
The flaw sits in Submariner's cert-auth mode. Connection configuration is built from free-form strings pulled out of a Custom Resource Definition (CRD) without proper validation. A malicious cluster can publish a CableName value containing newlines and ipsec.conf directives, which get written straight into the generated configuration.
That gives an attacker two paths: inject arbitrary configuration parameters, or execute commands via leftupdown hooks. The end result is remote code execution as root on the gateway node. Red Hat classifies the weakness as CWE-94 (Improper Control of Generation of Code).
Why It Matters
Red Hat scores this 9.1 CRITICAL, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Two details drive the severity. Scope is Changed, meaning the compromise escapes the vulnerable component's security boundary, which tracks with root-level execution on the gateway host. And attack complexity is Low with no user interaction required.
The mitigating factor is that privileges required is High: the attacker needs control of a participating cluster to publish the malicious CRD. In a multi-cluster Submariner mesh, that reframes the trust model; one compromised or hostile member cluster can pivot to root on a gateway node in the broker relationship.
CISA has not added CVE-2026-66786 to the Known Exploited Vulnerabilities catalog, and the supplied data contains no evidence of active exploitation.
What's Vulnerable
Red Hat lists Red Hat Advanced Cluster Management for Kubernetes 2 (cpe:/a:redhat:acm:2) as affected, with a default status of affected across these packages:
rhacm2/submariner-gateway-rhel9rhacm2/submariner-route-agent-rhel9rhacm2/submariner-globalnet-rhel9rhacm2/submariner-rhel9-operatorrhacm2/submariner-operator-bundlerhacm2/submariner-addon-rhel9rhacm2/subctl-rhel9rhacm2/lighthouse-agent-rhel9rhacm2/lighthouse-coredns-rhel9
Patch Status
The CVE was published 2026-09-02 and remains in NVD status Received. No fixed versions or vendor remediation steps are present in the supplied data. Consult the Red Hat security advisory below for current patch availability, and treat cert-auth mode deployments with untrusted or semi-trusted member clusters as the priority exposure.
Sources
- NVD, CVE-2026-66786: https://nvd.nist.gov/vuln/detail/CVE-2026-66786
- Red Hat Security; CVE-2026-66786: https://access.redhat.com/security/cve/CVE-2026-66786
- Red Hat Bugzilla #2507531: https://bugzilla.redhat.com/show_bug.cgi?id=2507531