Red Hat Advanced Cluster Management for Kubernetes 2.17 — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in Red Hat Advanced Cluster Management for Kubernetes 2.17, with AI-generated Chinese analysis, references, and POCs.

Vendor: Red Hat

CVE ID	Title	CVSS	Severity	Published
CVE-2026-66786	Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets CWE-94	9.1	Critical	2026-09-02
CVE-2026-66788	Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label CWE-1104	9.9	Critical	2026-08-20
CVE-2026-66787	Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses CWE-345	8.7	High	2026-08-20
CVE-2026-66785	Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack CWE-345	8.7	High	2026-08-20
CVE-2026-66783	Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref CWE-1357	4.4	Medium	2026-08-18
CVE-2026-66782	Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps CWE-269	5.8	Medium	2026-08-18
CVE-2026-71467	Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing CWE-287	7.5	High	2026-08-11

All 7 known CVE vulnerabilities affecting Red Hat Advanced Cluster Management for Kubernetes 2.17 with full Chinese analysis, references, and POCs where available.