CVE-2026-66788: Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-20 · updated 2026-10-19
Weakness: CWE-1104

Description

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

Affected products

Red Hat Advanced Cluster Management for Kubernetes 2.16: all versions — fixed in 1790670231, 1790670243, 1790670439, 1790670912
Red Hat Advanced Cluster Management for Kubernetes 2.17: all versions — fixed in 1788023916, 1788023940, 1788073481, 1788105072

How to fix

Upgrade to a fixed version: Red Hat Advanced Cluster Management for Kubernetes 2.16 1790670231, 1790670243, 1790670439, 1790670912; Red Hat Advanced Cluster Management for Kubernetes 2.17 1788023916, 1788023940, 1788073481, 1788105072. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66788 or the next vulnerability affects your stack