CVE-2026-66781 in Advanced Cluster Management for Kubernetes
Summary
by MITRE • 08/18/2026
A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The Submariner operator facilitates multi-cluster connectivity within Kubernetes environments by establishing secure tunnels between disparate cluster networks. A critical security flaw has been identified in how this system handles cryptographic material during configuration. Specifically, when administrators define network connectivity parameters using the Submariner Custom Resource, the IPsec pre-shared key required to authenticate and encrypt traffic is persisted in an unencrypted format within the Kubernetes API server storage backend. This architectural decision means that the secret value exists as plaintext data rather than being protected by encryption at rest or managed through a dedicated secrets management system with restricted access controls.
The technical flaw stems from the improper handling of sensitive configuration data during the resource creation and update processes. Instead of leveraging Kubernetes native mechanisms for secure secret storage, such as encrypted Secret objects or external vault integrations, the operator writes the pre-shared key directly into the Custom Resource definition. This results in the exposure of cryptographic credentials to any entity with read access to the specific namespace or cluster resources where Submariner is deployed. In environments where RBAC policies are not strictly enforced, this represents a significant lapse in defense-in-depth principles, as it bypasses standard security boundaries designed to protect authentication material.
From an operational impact perspective, the exposure of these pre-shared keys allows for severe confidentiality breaches. An attacker who gains access to the unencrypted key can perform passive decryption of all IPsec traffic flowing between any two clusters connected by that specific tunnel configuration. This capability effectively neutralizes the encryption layer intended to protect data in transit, enabling the interception and reading of sensitive information such as application payloads, internal service communications, and potentially user credentials transmitted over the mesh network. The compromise is not limited to immediate session hijacking but extends to historical traffic if logs or captures are available, given that the key remains static for the duration of its validity.
This vulnerability aligns with CWE-312, which classifies issues related to cleartext storage of sensitive information, and maps directly to ATT&CK technique T1557, Adversary-in-the-Middle, as it facilitates man-in-the-middle attacks by providing the necessary decryption keys for passive eavesdropping. The risk is exacerbated in shared multi-tenant environments where different teams or users may have varying levels of access to Kubernetes resources, increasing the likelihood that an unauthorized actor could discover and exploit this misconfiguration.
To mitigate this vulnerability, immediate remediation steps should focus on rotating all affected pre-shared keys across the Submariner mesh to invalidate any potentially compromised credentials. Following rotation, administrators must reconfigure the Submariner operator to utilize secure storage mechanisms for sensitive data. This includes implementing Kubernetes Secrets with encryption at rest enabled via an EncryptionConfiguration resource or integrating with external secret management solutions like HashiCorp Vault or AWS Secrets Manager. Additionally, strict Role-Based Access Control policies should be enforced to ensure that only privileged service accounts have access to the Submariner Custom Resources and associated secrets, thereby reducing the attack surface for unauthorized retrieval of cryptographic material.