VDB

CVE-2026-66783

CVE-2026-66783 PUBLISHED CVSS 4.4 MEDIUM

Reported by redhat · Published August 18, 2026

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

Risk Scores

CVSS 3.1
4.4
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171788105072
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171788073481
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171788105072
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.171788073481
Red HatRed Hat Advanced Cluster Management for Kubernetes 2

Timeline

  • Aug 18, 2026 CVE Published
  • Aug 20, 2026 Coalition ESS Score
  • Aug 20, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Sep 2, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 4, 2026 Distribution Patch
  • Sep 4, 2026 Security Advisory
  • Sep 8, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›