CVE-2026-66783

Published: Aug 18, 2026Modified: Sep 3, 2026

4.4

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Exploitability: 1.3 / Impact: 2.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

Related CWEs

CWE-1357

Reliance on Insufficiently Trustworthy Component

The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://access.redhat.com/errata/RHSA-2026:63016

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-66783

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2507528

Source: secalert@redhat.com

Timeline

No history available yet.