CVE-2026-66781Medium· 5.4▾ SunlitA flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.
rhacm2/submariner-addon-rhel9 (all versions)rhacm2/submariner-addon-rhel9 (all versions)rhacm2/submariner-addon-rhel9 (all versions)rhacm2/submariner-addon-rhel9 (all versions)rhacm2/submariner-addon-rhel9 (all versions)rhacm2/subctl-rhel9 (all versions)rhacm2/submariner-rhel9-operator (all versions)rhacm2/submariner-addon-rhel9 (all versions)rhacm2/subctl-rhel9 (all versions)rhacm2/submariner-rhel9-operator (all versions)rhacm2/submariner-operator-bundle (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate the risk of IPsec pre-shared key (PSK) disclosure, implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit access to Submariner Custom Resources. Ensure that only authorized administrators and systems are granted permissions to view submariner Custom Resources within their namespaces. Additionally, exercise caution when collecting and storing diagnostic data, such as must-gather bundles, and when managing GitOps repositories, as these may inadvertently expose the cleartext PSK.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66780Medium· 6.5A flaw was found in the submariner-operator component
CVE-2026-14620Medium· 4.7webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the …
CVE-2026-112259Medium· 5.5Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
CVE-2026-112260High· 7.1Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
CVE-2026-103314High· 7.4Stackrox: stackrox: saml response replay allows multiple central authentication tokens
CVE-2026-112214Medium· 6.5Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser