CVE-2026-66780: Red Hat Advanced Cluster Management For Kubernetes 2

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.

Affected products

• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.11: before 1789135606 (fixed in 1789135606)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.13: before 1789131397 (fixed in 1789131397)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.14: before 1789136328 (fixed in 1789136328)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.15: before 1789136327 (fixed in 1789136327)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.16: before 1789136320 (fixed in 1789136320); before 1787854416 (fixed in 1787854416)
• Red Hat Red Hat Advanced Cluster Management For Kubernetes 2.17: before 1788105072 (fixed in 1788105072); before 1788073481 (fixed in 1788073481); before 1788572527 (fixed in 1788572527)

Published 2026-08-18. Last modified 2026-09-29.