CVE-2026-66783 in Advanced Cluster Management for Kubernetes
Summary
by MITRE • 08/18/2026
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes represents a critical security flaw rooted in insufficient input validation during container image specification. This issue specifically affects users who possess administrative privileges within the cluster or have been granted permissions to modify the Submariner Custom Resource definitions. The core technical deficiency lies in the operator's failure to validate the integrity, source, and trustworthiness of the container image paths provided by these privileged users before deployment. By allowing an unvalidated image path to be processed without rigorous checks against a trusted registry or signature verification mechanisms, the system creates a direct pathway for privilege escalation attacks that can compromise the entire cluster infrastructure.
From a technical perspective, this flaw aligns with CWE-20 Improper Input Validation and CWE-94 Code Injection via Untrusted Control Sequences. When an attacker exploits this vulnerability, they are able to inject references to malicious container images hosted on untrusted registries into the Submariner configuration. Because submariner-operator runs with high-level privileges necessary for managing network policies and cluster connectivity across multiple Kubernetes environments, any image it deploys inherits these elevated permissions. Consequently, a compromised or maliciously crafted image can execute arbitrary commands within the context of the operator pod, which typically operates on control-plane nodes where sensitive components such as the API server etcd database are located.
The operational impact of this vulnerability is severe and far-reaching. An attacker who successfully exploits this flaw gains the ability to achieve full cluster compromise by executing code with elevated privileges across all managed clusters connected via Submariner. This includes the potential for lateral movement from worker nodes to control-plane nodes, where critical system components reside. The attacker could exfiltrate sensitive data stored in etcd, manipulate network policies to intercept traffic between services or clusters, install persistent backdoors that survive pod restarts, and potentially disrupt service availability by modifying cluster configurations. Since Submariner is designed to facilitate connectivity across multiple Kubernetes clusters, the blast radius extends beyond a single namespace or node pool, affecting the entire multi-cluster topology managed by Red Hat Advanced Cluster Management.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework for both Enterprise and Kubernetes environments. It corresponds to T1505.003 Server Software Component: Container Image Hijacking, where attackers replace legitimate container images with malicious ones. Additionally, it relates to T1498 Network Denial of Service via Resource Exhaustion if the attacker uses the elevated privileges to disrupt services, and potentially T1078 Valid Accounts if initial access was gained through compromised credentials that allowed modification of the Submariner Custom Resources. The ability to deploy arbitrary code on control-plane nodes also touches upon T1496 Remote File Copy for establishing persistence or further exploitation vectors within the cluster infrastructure.
Mitigation strategies must focus on immediate remediation and long-term hardening practices. Red Hat has released updates that address this vulnerability, and administrators should apply these patches immediately to all affected versions of Advanced Cluster Management and submariner-operator components. In addition to patching, organizations should enforce strict role-based access control (RBAC) policies to limit who can modify Submariner Custom Resources, ensuring that only highly trusted service accounts or senior administrators have write permissions. Implementing admission controllers such as OPA Gatekeeper or Kyverno can provide an additional layer of defense by validating image references against allowlists before they are accepted into the cluster. Furthermore, adopting a zero-trust architecture for container registries and enforcing signature verification using tools like Cosign ensures that only images from trusted sources with valid cryptographic signatures are deployed, thereby neutralizing the attack vector even if input validation is bypassed or misconfigured.