CVE-2026-66786— Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
Quick assessment
Affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 submariner 中发现了缺陷。在 cert-auth 模式下，连接配置是使用来自自定义资源定义（CRD）的自由格式字符串构建的，且缺乏适当的验证。恶意集群可以通过发布包含换行符和 ipsec.conf 指令的 CableName 来利用此缺陷。这使得攻击者能够注入任意配置参数，或通过 leftupdown 钩子执行命令，从而在网关节点上以 root 权限执行任意代码，实现远程代码执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66786
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
II. Public POCs for CVE-2026-66786
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66786
请登录查看更多情报信息。
Other References for CVE-2026-66786 (2)
Same Patch Batch · Red Hat · 2026-09-02 · 8 CVEs total
| CVE-2026-78408 | 7.9 HIGH | Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| CVE-2026-84838 | 7.8 HIGH | Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() |
| CVE-2026-84837 | 7.8 HIGH | Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path |
| CVE-2026-78410 | 7.8 HIGH | Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.own |
| CVE-2026-78409 | 7.0 HIGH | Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediat |
| CVE-2026-82968 | 6.4 MEDIUM | Keycloak-services: keycloak-services: cross-session email verification proof not bound to |
| CVE-2026-53683 | 4.3 MEDIUM | Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html |
IV. Related Vulnerabilities
Same product: Red Hat Advanced Cluster Management for Kubernetes 2
-
CVE-2026-66788
Lighthouse: dockerfile build stages use end-of-life fedora 4 -
CVE-2026-66787
Lighthouse: go pprof profiling endpoint enabled unconditiona -
CVE-2026-66785
Submariner: ipsec psk secrets file created with default worl -
CVE-2026-66780
Submariner-operator: broker serviceaccount secret (token + c -
CVE-2026-66783
Submariner-operator: release workflow consumes same-org comp
Same vendor: Red Hat
-
CVE-2026-84838
Rpm: command injection in rpmuncompress via unescaped filena -
CVE-2026-84837
Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via -
CVE-2026-78409
Util-linux: util-linux: x-mount.subdir detached-tree resolut -
CVE-2026-78410
Util-linux: util-linux: restricted bind mounts do not pin th -
CVE-2026-78408
Util-linux: util-linux: nsenter --join-cgroup leaks root cgr
Same weakness: CWE-94
-
CVE-2026-49832
DSpace: Remote Code Execution (RCE) possible in Velocity Tem -
CVE-2026-52833
Nuclio: Unsanitized runtimeAttributes.repositories injected -
CVE-2026-58572
Dell PowerStore代码注入：受限用户可获root权限 -
CVE-2026-18808
Unauthenticated Remote Code Execution via Code Injection in -
CVE-2026-4813
Code injection in the Lutece Core
V. Comments for CVE-2026-66786
No comments yet