CVE-2026-66786

Submariner, when operating in certificate-based (cert-auth) authentication mode, builds its IPsec connection configuration from free-form strings taken from the Custom Resource Definition without validating them. A malicious or compromised connected cluster with sufficient privileges can publish a CableName containing newlines and arbitrary ipsec.conf directives, injecting configuration parameters or commands that are executed through leftupdown hooks. Successful exploitation yields arbitrary command execution as root on the target cluster's gateway node, giving the attacker full control of that host (hence the scope change in the CVSS score). Affected parties are organizations running Submariner in cert-auth mode to connect multiple Kubernetes clusters, where a less-trusted peer cluster can influence another cluster's gateway; the high-privilege prerequisite (PR:H) limits the attack to configurations with cross-cluster trust. Exploitation status: no known exploitation in the wild, no public proof-of-concept, not listed in CISA KEV, and a modest 0.7% EPSS probability of exploitation within 30 days.

What to do: Confirm whether your deployment uses cert-auth mode, and upgrade Submariner gateway components to the patched release identified in Red Hat's advisory (fixed versions are not specified in the available data). As interim mitigation, restrict RBAC permissions to write the Submariner CRDs (especially CableName) to trusted clusters only, and audit existing CableName values for embedded newlines or unexpected ipsec.conf directives. Given the flaw allows root execution on gateway nodes, also review what else runs on gateway hosts and monitor them for anomalous processes or hook-based command execution.