CVE-2026-66783

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Red Hat Advanced Cluster Management

Publication date: 2026-08-18

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-03

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-66783

EUVD

EUVD-2026-61067

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	submariner_operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-1357	The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.

Attack-Flow Graph

Executive Summary

This vulnerability is in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. It allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path. This enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized modifications to Submariner Custom Resources (CRs) and validating image paths. Review Submariner CR configurations for untrusted image paths. Use commands like kubectl get submariner -A to inspect CRs and kubectl describe submariner <name> -n <namespace> to check image overrides. Look for suspicious image references in the output.

Impact Analysis

An attacker could exploit this to gain full control over your Kubernetes cluster, including all nodes and sensitive data. They could deploy malicious code with high privileges, potentially leading to data breaches, service disruption, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements like GDPR (data protection) and HIPAA (healthcare data privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Restrict access to cluster-admin roles and limit permissions for users or service accounts that can modify Submariner CRs. Only allow trusted personnel to patch Submariner CRs. Regularly audit Submariner CR configurations and image paths. Apply patches or updates from Red Hat as they become available to address the improper input validation issue.

Hi! I’m here to help you understand CVE-2026-66783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70