Cyber & AI intelligence
Wasteland.
Briefs indexed2378
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-66786 2026-09-02

CVE-2026-66786: Submariner Config Injection Grants Root RCE on Kubernetes Gateway Nodes

"A critical (CVSS 9.1) code injection flaw in Submariner lets a malicious cluster inject arbitrary IPsec configuration through an unvalidated CableName field, resulting in remote code execution as root on the gateway…"

A critical (CVSS 9.1) code injection flaw in Submariner lets a malicious cluster inject arbitrary IPsec configuration through an unvalidated CableName field, resulting in remote code execution as root on the gateway node.

What Is It

The flaw sits in Submariner's cert-auth mode. Connection configuration is built from free-form strings pulled out of a Custom Resource Definition (CRD) without proper validation. A malicious cluster can publish a CableName value containing newlines and ipsec.conf directives, which get written straight into the generated configuration.

That gives an attacker two paths: inject arbitrary configuration parameters, or execute commands via leftupdown hooks. The end result is remote code execution as root on the gateway node. Red Hat classifies the weakness as CWE-94 (Improper Control of Generation of Code).

Why It Matters

Red Hat scores this 9.1 CRITICAL, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Two details drive the severity. Scope is Changed, meaning the compromise escapes the vulnerable component's security boundary, which tracks with root-level execution on the gateway host. And attack complexity is Low with no user interaction required.

The mitigating factor is that privileges required is High: the attacker needs control of a participating cluster to publish the malicious CRD. In a multi-cluster Submariner mesh, that reframes the trust model; one compromised or hostile member cluster can pivot to root on a gateway node in the broker relationship.

CISA has not added CVE-2026-66786 to the Known Exploited Vulnerabilities catalog, and the supplied data contains no evidence of active exploitation.

What's Vulnerable

Red Hat lists Red Hat Advanced Cluster Management for Kubernetes 2 (cpe:/a:redhat:acm:2) as affected, with a default status of affected across these packages:

Patch Status

The CVE was published 2026-09-02 and remains in NVD status Received. No fixed versions or vendor remediation steps are present in the supplied data. Consult the Red Hat security advisory below for current patch availability, and treat cert-auth mode deployments with untrusted or semi-trusted member clusters as the priority exposure.

Sources