CVE-2026-66782
Awaiting Analysis Awaiting Analysis - Queue

Submariner Operator Exposes Long-Lived Broker SA Token

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-09-03
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-66782
EUVD
EUVD-2026-61066

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat submariner *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Submariner operator involves a long-lived broker service account bearer token stored in cleartext within the Submariner Custom Resource specification. Attackers with access to the cluster's etcd database or via kubectl get commands could retrieve this token, gaining full control over the mesh network and unauthorized management of network resources like endpoints and secrets.

Detection Guidance
  • Check Submariner Custom Resource (CR) specifications for exposed bearer tokens using kubectl get submariner.submariner.io -o yaml
  • Inspect etcd database for Submariner CR entries containing sensitive tokens
  • Review Kubernetes RBAC policies for unauthorized read access to Submariner CRs
  • Use kubectl get secrets -n submariner-operator to check for exposed service account tokens
Impact Analysis

If exploited, this vulnerability allows attackers to gain full control over the Submariner mesh network. This includes unauthorized management of endpoints, secrets, and endpoint slices within the broker namespace. Attackers could perform CRUD operations, potentially compromising the entire network infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating compliance requirements under GDPR and HIPAA. The cleartext storage of sensitive tokens and potential data breaches may result in regulatory penalties and loss of trust due to compromised confidentiality and integrity of data.

Mitigation Strategies
  • Implement strict RBAC policies to restrict read access to Submariner CRs to authorized personnel only
  • Review and enforce least privilege principles in existing RBAC configurations
  • Rotate all broker service account bearer tokens immediately
  • Upgrade submariner-operator to a patched version if available

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66782. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart