---
id: CVE-2026-66780
title: A flaw was found in the submariner-operator component
summary: >-
  A flaw was found in the submariner-operator component. The
  `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters,
  possesses excessive permissions. This allows a compromised cluster to alter
  network configurations, sp…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-532
vendor: Red Hat
product: rhacm2/submariner-addon-rhel9
affected:
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/subctl-rhel9 (all versions)
  - rhacm2/submariner-rhel9-operator (all versions)
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/submariner-operator-bundle (all versions)
published: '2026-08-18'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T12:17:16.303'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66780'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:63016'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67538'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67539'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67540'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67541'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67542'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:67543'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-66780'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507524'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66780.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-66780'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66780'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-18T18:44:52.061095Z'
epss: 0.0032
epssPercentile: 0.25181
ingestedAt: '2026-09-21T11:35:54.436Z'
patched:
  - advanced_cluster_management_for_kubernetes 2.11
  - advanced_cluster_management_for_kubernetes 2.13
  - advanced_cluster_management_for_kubernetes 2.14
  - advanced_cluster_management_for_kubernetes 2.15
  - advanced_cluster_management_for_kubernetes 2.16
  - advanced_cluster_management_for_kubernetes 2.17
---

## Overview

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67538** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67538)
- **RHSA-2026:67540** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67540)
- **RHSA-2026:67539** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67539)
- **RHSA-2026:67541** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67541)
- **RHSA-2026:67542** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67542)
- **RHSA-2026:63016** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63016)
- **RHSA-2026:67543** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67543)
- **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66780.json)