CVE-2026-66781

Awaiting Analysis Awaiting Analysis - Queue

Submariner Operator IPsec PSK Credential Exposure

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-66781

EUVD

EUVD-2026-61065

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	submariner	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Submariner operator storing the IPsec pre-shared key (PSK) in an unencrypted format within the Submariner Custom Resource (CR). The PSK is used to secure communication between Kubernetes clusters but is exposed to unauthorized parties who can access the CR. This allows attackers to decrypt network traffic between any two clusters in the mesh, leading to sensitive information disclosure.

Detection Guidance

Check for exposed Submariner Custom Resources by running kubectl get submariner -o yaml in your Kubernetes cluster. This command will reveal if the IPsec pre-shared key (PSK) is stored in cleartext within the CR specification.

Impact Analysis

If exploited, this vulnerability enables attackers to passively decrypt network traffic between connected Kubernetes clusters. This could lead to exposure of sensitive data transmitted between clusters. The impact is severe because the PSK is shared across all clusters, meaning a compromise on one cluster could affect the entire mesh.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA due to unauthorized access and decryption of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Exposure of such data through decryption could result in legal penalties and reputational damage.

Mitigation Strategies

Implement strict Kubernetes RBAC policies to restrict access to Submariner Custom Resources. Ensure only authorized administrators can view or modify them. Avoid storing diagnostic data or GitOps repositories containing the PSK in unsecured locations.

Hi! I’m here to help you understand CVE-2026-66781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70