CVE-2026-66781 Submariner Operator IPsec PSK Stored in Cleartext

Vulnerability Overview CVE ID: CVE-2026-66781 Description: A vulnerability was discovered in the Submariner operator. The Submariner Custom Resource (CR) is used to configure network connectivity and stores IPsec pre-shared keys (PSKs) in an unencrypted format. This key is critical for securing communication between Kubernetes clusters, but it can be accessed by unauthorized parties. Such access allows attackers to passively decrypt network traffic flowing between the two clusters, leading to the leakage of sensitive information. Impact Scope Vulnerability Impact: This vulnerability exposes IPsec pre-shared keys (PSKs) in the submariner-operator, displayed in plaintext within the Submariner Custom Resource (CR) specification. Since Custom Resources are not encrypted by default in etcd, and the PSK is identical across all clusters, an attacker with appropriate permissions can passively decrypt traffic between any two connected clusters by using or through must-gather bundles. Remediation Mitigation Measures: To reduce the risk of IPsec pre-shared key (PSK) exposure, implement strict Kubernetes Role-Based Access Control (RBAC) policies to restrict access to Submariner Custom Resources. Ensure that only authorized administrators and systems are granted permission to view “submariner” Custom Resources. Additionally, exercise caution when collecting and analyzing diagnostic data (such as must-gather bundles) and managing GitOps repositories, as these actions may inadvertently expose the clearest PSK. Additional Information CVSS Score: 6.5 Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality Impact: High Integrity Impact: None Availability Impact: None Vector Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Understanding Weakness (CWE) CWE ID: CWE-312 Confidentiality: Technical Impact: Read Application Data Description: An attacker with system access can read sensitive information stored in plaintext (i.e., unencrypted). Even if the information is encoded in an unreadable manner, certain techniques can determine the encoding being used and subsequently decode the information. Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? My product is listed as “Under Investigation” or “Affected”; when will Red Hat release a fix for this vulnerability? What can I do if my product is listed as “Will Not Fix”? What can I do if my product is listed as “Deferred Fix”? What are mitigation measures? I have a Red Hat product, but it is not listed above; is it affected? Why does my security scanner report that my product is vulnerable to this issue, even though my product version is fixed or unaffected? Last Modified Last Modified Date: 2021 Copyright: CVE Description Copyright © 2021

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-66781 Submariner Operator IPsec PSK Stored in Cleartext

More from this source