CVE-2026-66783
Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
- State
- Published
- Severity
- 4.4 Medium
- Published
- Aug 18, 2026
- Updated
- Oct 19, 2026
- Reserved
- Jul 27, 2026
Description
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.4 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-1357 Reliance on Insufficiently Trustworthy Component
Affected Products
| Product | Versions |
|---|---|
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat |
|
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat | |
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat |
References
- RHSA-2026:63016vendor-advisory
- RHSA-2026:85227vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-66783vdb-entry
- RHBZ#2507528issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.