CVE-2026-66786— Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
Quick assessment
Affected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Submariner Operator是Submariner团队开源的一个提供跨集群网络连接能力的网络产品。 Submariner Operator存在代码注入漏洞，该漏洞源于cert-auth模式下连接配置使用来自自定义资源定义（CRD）的自由格式字符串且未经过适当验证，攻击者可利用包含换行符和ipsec.conf指令的CableName注入任意配置参数或通过leftupdown hooks执行命令，导致在网关节点上以root身份远程代码执行。
Affected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | 1790670439< * |
unaffected |
1790670231< * |
unaffected | ||
1790670243< * |
unaffected | ||
1790670508< * |
unaffected | ||
1790670233< * |
unaffected | ||
1790670912< * |
unaffected | ||
1790670254< * |
unaffected | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.17 | 1788023916< * |
unaffected |
1788023940< * |
unaffected | ||
1788105072< * |
unaffected | ||
1788043964< * |
unaffected | ||
1788043961< * |
unaffected | ||
1788073481< * |
unaffected | ||
1788043970< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66786
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Submariner Operator 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Submariner Operator是Submariner团队开源的一个提供跨集群网络连接能力的网络产品。 Submariner Operator存在代码注入漏洞，该漏洞源于cert-auth模式下连接配置使用来自自定义资源定义（CRD）的自由格式字符串且未经过适当验证，攻击者可利用包含换行符和ipsec.conf指令的CableName注入任意配置参数或通过leftupdown hooks执行命令，导致在网关节点上以root身份远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-66786
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66786
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66786 (4)
Same Patch Batch · Red Hat · 2026-09-02 · 8 CVEs total
| CVE-2026-78408 | 7.9 HIGH | Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| CVE-2026-84838 | 7.8 HIGH | Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() |
| CVE-2026-84837 | 7.8 HIGH | Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path |
| CVE-2026-78410 | 7.8 HIGH | Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.own |
| CVE-2026-78409 | 7.0 HIGH | Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediat |
| CVE-2026-82968 | 6.4 MEDIUM | Keycloak-services: keycloak-services: cross-session email verification proof not bound to |
| CVE-2026-53683 | 4.3 MEDIUM | Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html |
IV. Related Vulnerabilities
Same product: Red Hat Advanced Cluster Management for Kubernetes 2.16
-
CVE-2026-66788
Lighthouse: lighthouse: arbitrary namespace injection via at -
CVE-2026-66787
Lighthouse: lighthouse: cross-cluster dns spoofing via unval -
CVE-2026-66785
Submariner: submariner: missing validation of remote endpoin -
CVE-2026-66783
Submariner-operator: release workflow consumes same-org comp -
CVE-2026-66782
Submariner-operator: operator clusterrole grants cluster-wid
Same vendor: Red Hat
-
CVE-2026-115486
Open-iscsi: open-iscsi: ipv6 neighbor discovery missing opti -
CVE-2026-115485
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out -
CVE-2026-115484
Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bou -
CVE-2026-115449
Libslirp: libslirp: icmp echo reply length desynchronization -
CVE-2026-115221
Ipa: freeipa: freeipa uses subject cn as proof of certificat
Same weakness: CWE-94
-
CVE-2026-115935
Control panel only API response emulation replaces "security -
CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized im -
CVE-2026-53942
Conda Organization Infrastructure: Pwn Request in update wor -
CVE-2025-30050
Remote Code Execution in CGM CLININET -
CVE-2025-30045
Code Injection in CGM CLININET
V. Comments for CVE-2026-66786
No comments yet