CVE-2026-66788: Lighthouse Arbitrary Namespace Injection via LabelSourceNamespace

Vulnerability Overview Vulnerability ID: CVE-2026-66788 Vulnerability Name: Lighthouse: Arbitrary Local Namespace Injection via Attack-Controlled LabelSourceNamespace Status: NEW Report Date: 2026-07-27 15:44 UTC by OSIDB Bzimport Modified Date: 2026-08-20 17:40 UTC CC List: 3 users (china) Product: Security Response Component: vulnerability Version: unspecified Hardware: All OS: Linux Priority: high Severity: high Target Milestone: --- Assigned To: Product Security QA Contact: --- Docs Contact: --- URL: --- Whiteboard: --- Depends On: --- Blocks: --- Tree View: depends on / blocked Scope of Impact Affected Versions: unspecified Closed Versions: unspecified Environment: unspecified Last Closed: unspecified Hidden: unspecified Remediation Description: - The target namespace in the local cluster is retrieved directly from labels/annotations on proxy objects, which are fully under the attacker's control. The Lighthouse-agent SA (which holds cluster-scoped / RBAC permissions for and ) then writes objects to this namespace, representing the remote cluster. There is no allowList, no check to verify if the namespace is locally owned, and no check to verify if the source cluster has the authority to export that . A compromised spoke can inject and into any namespace, including and namespaces. - Source: Project Databasing AI-SAST audit of submariner-io/lighthouse - Finding ID: FIND-002 - Assurance: execution_proven POC Code or Exploit Code No specific POC code or exploit code is included on the page. Additional Information Attachments: 2026-07-27 15:44:52 UTC Description: Detailed description from the remediation section above. Notes Login is required to comment on or modify this bug. --- Summary: This vulnerability involves an arbitrary local namespace injection issue in the Lighthouse component. An attacker can inject and into any namespace, including and namespaces, by controlling the . The current status is NEW, and no specific remediation has been provided yet.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-66788: Lighthouse Arbitrary Namespace Injection via LabelSourceNamespace