CVE-2026-66786
Received Received - Intake

Submariner Gateway Remote Code Execution via Malicious CableName

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: redhat-SADP

Description
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-66786
EUVD
EUVD-2026-70247

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
submariner submariner *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Submariner allows a malicious cluster to inject malicious configuration into IPsec setup by crafting a CableName with newlines and directives. It enables remote code execution as root on the gateway node through leftupdown hooks due to improper validation of free-form strings in the CRD.

Detection Guidance

Check Submariner gateway nodes for unexpected ipsec.conf configurations or leftupdown hook executions. Inspect CRDs for malicious CableName or Subnets fields containing newlines or ipsec.conf directives. Monitor for unauthorized root-level command execution on gateway nodes.

Impact Analysis

An attacker could gain root access on the gateway node, allowing them to execute arbitrary commands, manipulate network traffic, or compromise the entire cluster. Exploitation requires specific non-default configurations and cluster-admin access.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating compliance requirements for data protection and security such as GDPR and HIPAA. It undermines confidentiality, integrity, and availability of sensitive data.

Mitigation Strategies

Switch to pre-shared key (PSK) authentication by setting IPSecCertAuthMode to false in the SubmarinerConfig CR and redeploy gateway pods. Disable cert-auth mode if enabled. Ensure cluster-admin credentials are not exposed and validate Endpoint resources before submission.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66786. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart