VDB
CVE-2026-66782
CVE-2026-66782
PUBLISHED
CVSS 5.8 MEDIUM
Reported by redhat · Published August 18, 2026
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.
Risk Scores
CVSS 3.1
5.8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | 1788105072 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | 1788073481 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | 1788105072 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | 1788073481 |
Timeline
- Aug 18, 2026 CVE Published
- Aug 20, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Sep 2, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 4, 2026 Distribution Patch
- Sep 4, 2026 Security Advisory
- Sep 8, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- RHSA-2026:63016 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2507527 issue-trackingx_refsource_REDHAT