Red Hat Advanced Cluster Management for Kubernetes CVE-2026-66788 Remote Privilege Escalation via EndpointSlices Injection

Vulnerability Overview CVE ID: CVE-2026-66788 Description: A vulnerability was identified in Lighthouse. A remote attacker can exploit a compromised spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on a peer cluster, including critical system namespaces such as and . This is achieved by deriving the target namespace from attacker-controlled labels or annotations during resource injection. This issue may lead to privilege escalation or other forms of system compromise. Severity: This vulnerability allows a compromised spoke cluster to inject EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters, including critical system namespaces. The service account uses attacker-controlled labels as the target namespace without validation, potentially leading to privilege escalation or service disruption. Scope of Impact Affected Product: Red Hat Advanced Cluster Management for Kubernetes CVSS Score: 9.9 (High) Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Impact: High (Confidentiality, Integrity, Availability) Remediation Mitigation: There are currently no available mitigation measures, or the available options do not meet Red Hat product security standards. Additional Information: The page provides detailed information about the CVSS score and impact, but does not include specific remediation steps or patch information. Additional Information FAQ: The page includes a frequently asked questions section explaining why Red Hat’s CVSS scores may differ from those of other vendors, and how to handle products in various states (e.g., “Under investigation,” “Affected,” “Will not fix”). Contact Information: For clarifications or corrections, please contact the Red Hat Product Security team. Summary This vulnerability (CVE-2026-66788) is a high-severity issue affecting Red Hat Advanced Cluster Management for Kubernetes, which may lead to privilege escalation or system compromise. There are currently no available mitigation measures. It is recommended to closely monitor Red Hat’s official announcements for updates and patches.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Advanced Cluster Management for Kubernetes CVE-2026-66788 Remote Privilege Escalation via EndpointSlices Injection