CVE-2026-66783
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- EPSS probability
- 0.28%
- CWE
- CWE-20, CWE-1357
- Published
- 2026-08-18
- Last modified
- 2026-09-03
Affected products
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17
Weakness type
Related vulnerabilities
- CVE-2026-3096 — Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
- CVE-2026-13745 — Arbitrary Code Execution in Gemini CLI via Symlinked Environment Variables
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-86768 — Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
- CVE-2025-71417 — PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
- CVE-2024-58380 — PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
- CVE-2023-54393 — PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
- CVE-2023-54392 — PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket