CVE-2026-66782: Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-19
Weakness: CWE-269

Description

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2: all versions
Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1790670243, 1790670912
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1788073481, 1788105072

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670243, 1790670912; Red Hat Advanced Cluster Management for Kubernetes 2.17 1788073481, 1788105072. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66782 or the next vulnerability affects your stack