Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity (Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11)

CVE-2026-66780
MEDIUM 6.5

En bref

Source
NVD
EPSS
EPSS 0.58 % · centile 48 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Awaiting Analysis

Rechercher sur…

Description

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Faiblesses (CWE)

  • CWE-532 — Informations sensibles insérées dans un fichier de journal

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nredhat
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · secalert@redhat.com (Secondary)

Références européennes

Produits affectés

ProduitVersions
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11unaffected 1789135606 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.13unaffected 1789131397 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.14unaffected 1789136328 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.15unaffected 1789136327 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1789136320 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1787854416 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1790670243 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.16unaffected 1790670912 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1788105072 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1788073481 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.17unaffected 1788572527 < *
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD