All 6 CVE vulnerabilities found in Red Hat Advanced Cluster Management for Kubernetes 2.16, with AI-generated Chinese analysis, references, and POCs.
Vendor: Red Hat
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-66786 | Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets CWE-94 | 9.1 | Critical | 2026-09-02 |
| CVE-2026-66788 | Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label CWE-1104 | 9.9 | Critical | 2026-08-20 |
| CVE-2026-66787 | Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses CWE-345 | 8.7 | High | 2026-08-20 |
| CVE-2026-66785 | Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack CWE-345 | 8.7 | High | 2026-08-20 |
| CVE-2026-66783 | Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref CWE-1357 | 4.4 | Medium | 2026-08-18 |
| CVE-2026-66782 | Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps CWE-269 | 5.8 | Medium | 2026-08-18 |
All 6 known CVE vulnerabilities affecting Red Hat Advanced Cluster Management for Kubernetes 2.16 with full Chinese analysis, references, and POCs where available.