# CVE-2026-66787

## Summary

- **CVE ID:** CVE-2026-66787
- **Severity:** MEDIUM
- **CVSS Score:** 5.4 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
- **CWE:** CWE-345, CWE-489
- **Published:** Aug 20, 2026
- **Last Modified:** Sep 3, 2026

## Description

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

## Affected Products

- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.17 (1788023916)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.17 (1788023940)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.17 (1788105072)
- Red Hat — Red Hat Advanced Cluster Management for Kubernetes 2.17 (1788073481)

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-66787)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2507532)
- [CNA](https://access.redhat.com/errata/RHSA-2026:63016)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.24%
- **EPSS Percentile:** 15.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._