CVE-2026-66788
Received Received - Intake

Remote Code Execution in Lighthouse

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: redhat-SADP

Description
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-66788
EUVD
EUVD-2026-63535

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
red_hat advanced_cluster_management_for_kubernetes lighthouse
red_hat advanced_cluster_management_for_kubernetes From 9.9 (inc)
redhat lighthouse *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66788 is a critical flaw in Lighthouse, a component of Red Hat Advanced Cluster Management for Kubernetes. It allows a remote attacker who compromises a spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system or openshift-*. The vulnerability arises because the lighthouse-agent writes objects into namespaces specified by attacker-controlled labels without validating namespace existence, ownership, or source cluster authorization.

The attacker exploits a lack of validation in the LabelSourceNamespace field to inject malicious objects, potentially leading to privilege escalation or system compromise across the cluster federation.

Detection Guidance

Check for unauthorized EndpointSlices or ServiceImports in critical namespaces like kube-system or openshift-* using kubectl commands such as kubectl get endpointslices -A or kubectl get serviceimports -A. Monitor logs from the lighthouse-agent for suspicious namespace injections or label/annotation modifications.

Impact Analysis

This vulnerability can lead to severe impacts such as unauthorized access to critical system namespaces, privilege escalation, or service disruption. Attackers could inject malicious EndpointSlices or ServiceImports into namespaces like kube-system, potentially compromising the entire cluster or enabling further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access to sensitive namespaces or data could result in legal penalties, reputational damage, and loss of trust due to compromised system integrity and confidentiality.

Mitigation Strategies

Isolate compromised spoke clusters immediately. Restrict permissions for the lighthouse-agent service account to prevent unauthorized namespace access. Monitor and audit namespace modifications and resource injections across clusters. Apply patches or updates from Red Hat once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart