CVE-2026-66787: Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

Severity: high (CVSS 8.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-20 · updated 2026-10-19
Weakness: CWE-345

Description

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1790670231, 1790670243, 1790670439, 1790670912
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1788023916, 1788023940, 1788073481, 1788105072

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670231, 1790670243, 1790670439, 1790670912; Red Hat Advanced Cluster Management for Kubernetes 2.17 1788023916, 1788023940, 1788073481, 1788105072. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66787 or the next vulnerability affects your stack