CVE-2026-66781— Submariner-operator: submariner-operator: ipsec psk stored cleartext in submariner cr spec
Quick assessment
Affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Submariner Operator 中发现了一个漏洞。用于配置网络连接的 Submariner 自定义资源（CR）以未加密格式存储 IPsec 预共享密钥（PSK）。该密钥对于保障 Kubernetes 集群之间的通信安全至关重要，但可能被未授权方访问。攻击者利用这种访问权限，可以被动解密网格中任意两个集群之间流动的网络流量，从而导致敏感信息泄露。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66781
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Submariner-operator: submariner-operator: ipsec psk stored cleartext in submariner cr spec
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
II. Public POCs for CVE-2026-66781
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66781
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66781 (2)
Same Patch Batch · Red Hat · 2026-08-18 · 14 CVEs total
| CVE-2026-66780 | 9.9 CRITICAL | Submariner-operator: submariner-operator: flat broker trust model grants every spoke full |
| CVE-2026-12564 | 9.6 CRITICAL | Automation-controller: automation-controller: kubernetes service account token exfiltratio |
| CVE-2026-18963 | 9.1 CRITICAL | Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentia |
| CVE-2026-66793 | 8.8 HIGH | Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary containe |
| CVE-2026-75924 | 8.7 HIGH | Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants clust |
| CVE-2026-66783 | 8.2 HIGH | Submariner-operator: submariner-operator: arbitrary image override enables privileged code |
| CVE-2026-66782 | 7.8 HIGH | Submariner-operator: submariner-operator: broker api bearer token stored cleartext in cr s |
| CVE-2026-71365 | 7.7 HIGH | Awx: webhook status callback ssrf leaks the git pat |
| CVE-2026-15571 | 7.3 HIGH | Keycloak-services: keycloak-services: predictable account-linking hash enables account tak |
| CVE-2026-75032 | 6.3 MEDIUM | Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder |
| CVE-2026-75485 | 5.5 MEDIUM | Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of |
| CVE-2026-73834 | 5.5 MEDIUM | Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redact |
| CVE-2026-19608 | 5.3 MEDIUM | Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy |
IV. Related Vulnerabilities
Same product: Red Hat Advanced Cluster Management for Kubernetes 2
-
CVE-2026-73137
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-67567
Multicloud-operators-subscription: multicloud-operators-subs -
CVE-2026-66788
Lighthouse: lighthouse: arbitrary local-namespace injection -
CVE-2026-66787
Lighthouse: lighthouse: cross-cluster dns spoofing via unval -
CVE-2026-66785
Submariner: submariner: unvalidated endpoint.spec.subnets pr
Same vendor: Red Hat
-
CVE-2026-17113
Cri-o: cri-o: unvalidated image env var causes daemon crash -
CVE-2026-78475
Gimp: unbounded stack vla and 21-byte stack over-read in pix -
CVE-2026-78465
Gimp: integer overflow in pcx loader (planes=4) leads to hea -
CVE-2026-19685
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage
Same weakness: CWE-312
-
CVE-2026-59657
Apache CloudStack: Sensitive Information Disclosure via Clea -
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76386
Information Disclosure through Action Parameters in Zoom app -
CVE-2026-76385
Information Disclosure through Action Parameters in Venafi a -
CVE-2026-76384
Information Disclosure through Action Parameters in Splunk A
V. Comments for CVE-2026-66781
No comments yet