CVE-2026-66786

Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets

State: Published
Severity: 9.1 Critical
Published: Sep 2, 2026
Updated: Oct 19, 2026
Reserved: Jul 27, 2026

Description

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	redhat

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670439 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670231 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670243 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670508 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670233 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670912 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.16Red Hat	1790670254 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788023916 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788023940 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788105072 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788043964 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788043961 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788073481 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2.17Red Hat	1788043970 and laterNot affected
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat

References

RHSA-2026:63016vendor-advisory
RHSA-2026:85227vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-66786vdb-entry
RHBZ#2507531issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.