CVE-2026-66780: Submariner Privilege Escalation Flaw

CVE-2026-66780 Overview

CVE-2026-66780 is a broken access control flaw [CWE-284] in the submariner-operator component used to connect Kubernetes clusters across cloud and on-premises environments. The submariner-k8s-broker-cluster Role assigned to joined clusters grants excessive permissions. A compromised member cluster can overwrite endpoint information belonging to other clusters in the mesh. This lets an attacker redirect inter-cluster tunnel traffic and perform a Man-in-the-Middle (MITM) attack across the entire cluster fabric.

Critical Impact
A single compromised joined cluster can intercept, read, and modify traffic flowing between all peer clusters connected through the Submariner broker.

Affected Products

Submariner submariner-operator component
Red Hat distributions bundling submariner-operator
Kubernetes clusters joined to a Submariner broker

Discovery Timeline

2026-08-18 - CVE-2026-66780 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66780

Vulnerability Analysis

Submariner establishes encrypted tunnels between Kubernetes clusters using a central broker. Each joined cluster registers an Endpoint custom resource that describes how peers should reach it. The submariner-k8s-broker-cluster Role controls what a joined cluster can do against those broker-side resources.

The Role grants write access broader than needed. A joined cluster can modify not only its own Endpoint entries but also entries owned by other clusters. Overwriting a peer's endpoint fields, such as the public IP address or backend configuration, causes remote clusters to build tunnels toward an attacker-controlled destination.

Once tunnel traffic terminates on the attacker's endpoint, the attacker can inspect, alter, or drop cross-cluster service traffic before forwarding it. The flaw affects confidentiality, integrity, and availability of every workload that relies on Submariner for cross-cluster connectivity.

Root Cause

The root cause is improper access control [CWE-284] in the RBAC definition of the submariner-k8s-broker-cluster Role. The Role's verbs and resource scope allow a joined cluster's service account to mutate Endpoint resources belonging to other clusters. Kubernetes RBAC does not enforce per-owner filtering on custom resources without explicit admission controls.

Attack Vector

An attacker who obtains the credentials or service account token of one joined cluster authenticates to the broker cluster with those credentials. Using standard kubectl or Kubernetes API calls, the attacker updates the target cluster's Endpoint object in the broker namespace. Peer clusters read the tampered endpoint, tear down their existing tunnel, and rebuild it toward the attacker-controlled address. From that position the attacker performs MITM interception on inter-cluster traffic. Refer to the Red Hat CVE-2026-66780 Advisory and Red Hat Bug #2507524 Details for technical context.

// No verified proof-of-concept code is publicly available for CVE-2026-66780.
// See the Red Hat advisory linked above for authoritative technical details.

Detection Methods for CVE-2026-66780

Indicators of Compromise

Unexpected modifications to Endpoint custom resources in the Submariner broker namespace originating from a cluster other than the resource owner.
New or changed tunnel destination IP addresses observed in Submariner gateway logs that do not match the documented public endpoints of peer clusters.
Repeated tunnel renegotiation events across multiple clusters within a short window.

Detection Strategies

Audit Kubernetes API server logs on the broker cluster for update and patch verbs against endpoints.submariner.io resources, correlating the acting service account with the resource owner label.
Baseline the set of expected peer endpoint IPs and alert on drift.
Monitor Submariner gateway pod logs for tunnel re-establishment events tied to endpoint changes.

Monitoring Recommendations

Ship broker cluster audit logs to a centralized analytics platform and alert on cross-cluster writes to Submariner CRDs.
Track service account token usage from joined clusters and flag API calls that touch resources labeled with a different cluster-id.
Verify tunnel peer identities through gateway metrics and compare against an authoritative inventory.

How to Mitigate CVE-2026-66780

Immediate Actions Required

Apply the fixed submariner-operator release once available from your distribution vendor. Consult the Red Hat CVE-2026-66780 Advisory for fixed package versions.
Rotate service account tokens and TLS materials for all joined clusters if compromise is suspected.
Review recent modifications to Endpoint resources in the broker namespace and revert unauthorized changes.

Patch Information

Red Hat tracks the fix in Red Hat Bug #2507524 Details. The corrective change tightens the submariner-k8s-broker-cluster Role so joined clusters can only modify endpoint resources that they own. Upgrade the submariner-operator on the broker cluster and on every joined cluster to a version that includes the RBAC fix.

Workarounds

Deploy a Kubernetes admission controller, such as Kyverno or OPA Gatekeeper, that rejects Endpoint writes when the requesting service account does not match the resource's owning cluster.
Restrict network reachability to the broker's API server so only trusted joined clusters can authenticate.
Segment high-value clusters onto a separate broker until the patched operator is deployed.

bash

# Example Kyverno policy skeleton to constrain Endpoint writes to owning cluster
# Adapt the label key to your Submariner deployment before applying
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-submariner-endpoint-writes
spec:
  validationFailureAction: Enforce
  rules:
    - name: enforce-endpoint-owner
      match:
        any:
          - resources:
              kinds:
                - Endpoint
              namespaces:
                - submariner-k8s-broker
      validate:
        message: "Joined clusters may only modify their own Endpoint resource"
        deny:
          conditions:
            any:
              - key: "{{ request.object.metadata.labels.\"submariner.io/clusterID\" }}"
                operator: NotEquals
                value: "{{ request.userInfo.username }}"