CVE-2026-66780: submariner-operator flat trust model allows spoke IPsec MITM attack

Vulnerability Overview Bug ID: Bug 2507524 (CVE-2026-66780) Vulnerability Name: submariner-operator: flat broker trust model grants every spoke full CRUD on all endpoints, secrets, and endpointslices in broker namespace Status: NEW Product: Security Response Component: vulnerability Priority: high Severity: high Reported On: 2026-07-27 15:43 UTC by OSDB Ezreport Last Modified: 2026-08-18 16:52 UTC Affected Systems Hardware: All OS: Linux Target Milestone: --- Assigned To: Product Security QA Contact: --- Documentation Contact: --- URL: --- Whiteboard: --- Dependencies: --- Blocks: --- Tree Visibility: depends on 0 blocked Fix Information Fixed Version: --- Closed Version: --- Environment: --- Last Closed: --- Embargoed: --- Detailed Description Description: - The Role is bound to the Service Account (SA) token of every joining cluster, granting full CRUD (Create, Read, Update, Delete) permissions for all endpoints, secrets, and endpoint slices in the broker namespace, without resource name restrictions. - Each cluster's gateway publishes an Endpoint CR containing its public IP, NAT IP, subnet, and cable driver parameters; peer gateways read these to establish tunnels. - A compromised spoke can overwrite the Endpoint CR of any other spoke, redirecting tunnel traffic to an attacker-controlled IP, thereby enabling IPsec Man-in-the-Middle (MITM) attacks across the entire cluster mesh. Source: Project Glasswing AI-SAST audit of submariner-io/submariner-operator. Finding ID: FIND-001 Assurance Level: machine_verified (static analysis + code-level execution proof) Attachments OSDB Ezreport: 2026-07-27 15:43:48 UTC Comments Logging in is required to comment or make changes to this bug.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-66780: submariner-operator flat trust model allows spoke IPsec MITM attack