Vulnerability-Lookup

CVE-2026-66788 (GCVE-0-2026-66788)

Vulnerability from cvelistv5 – Published: 2026-08-20 18:15 – Updated: 2026-10-19 17:02

Title

Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

Summary

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 18:52 UTC

CWE

CWE-1104 - Use of Unmaintained Third Party Components

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1033 records in the last 180 days details

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:63016	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:85227	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-66788	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2507533	issue-trackingx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1790670439 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1790670231 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1790670243 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1790670912 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1788023916 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1788023940 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1788105072 , < * (rpm) cpe:/a:redhat:acm:2.17::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.17	Unaffected: 1788073481 , < * (rpm) cpe:/a:redhat:acm:2.17::el9

Date Public

2026-08-20 17:20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T18:52:23.727449Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T18:52:30.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670439",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670231",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/subctl-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670243",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670912",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788023916",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788023940",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/subctl-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788105072",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788073481",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2026-08-20T17:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1104",
              "description": "Use of Unmaintained Third Party Components",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T17:02:26.651Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:63016",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:63016"
        },
        {
          "name": "RHSA-2026:85227",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:85227"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-66788"
        },
        {
          "name": "RHBZ#2507533",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-27T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-20T17:20:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-1104: Use of Unmaintained Third Party Components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-66788",
    "datePublished": "2026-08-20T18:15:37.408Z",
    "dateReserved": "2026-07-27T17:51:24.885Z",
    "dateUpdated": "2026-10-19T17:02:26.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-66788",
      "date": "2026-10-20",
      "epss": "0.00658",
      "percentile": "0.50599"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.16::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/lighthouse-agent-rhel9",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1790670439",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.16::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/lighthouse-coredns-rhel9",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1790670231",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.16::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/subctl-rhel9",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1790670243",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.16::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/submariner-rhel9-operator",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1790670912",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.17::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/lighthouse-agent-rhel9",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1788023916",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.17::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/lighthouse-coredns-rhel9",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1788023940",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.17::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/subctl-rhel9",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1788105072",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:acm:2.17::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhacm2/submariner-rhel9-operator",
                "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "1788073481",
                    "versionType": "rpm"
                  }
                ]
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 una falla en Lighthouse. Un atacante remoto, al comprometer un cl\u00faster spoke, puede explotar una vulnerabilidad donde el espacio de nombres de destino para la inyecci\u00f3n de recursos se deriva de una etiqueta o anotaci\u00f3n controlada por el atacante en el objeto broker. Esto permite al atacante inyectar EndpointSlices y ServiceImports no autorizados en cualquier espacio de nombres en cl\u00fasteres pares, incluyendo espacios de nombres de sistema cr\u00edticos como kube-system y openshift-*. Esto podr\u00eda conducir a una escalada de privilegios u otras formas de compromiso del sistema dentro del cl\u00faster."
          }
        ],
        "id": "CVE-2026-66788",
        "lastModified": "2026-10-19T17:17:21.607",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.9,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 6.0,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-66788",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T18:52:23.727449Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-20T19:16:58.823",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2026:63016"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2026:85227"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2026-66788"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1104"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-19T17:02:22+00:00",
      "cve": "CVE-2026-66788",
      "id": "CVE-2026-66788",
      "initial_release_date": "2026-08-20T17:20:00+00:00",
      "product_status:fixed": "32",
      "product_status:known_not_affected": "34",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66788.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-66788",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-20T18:52:23.727449Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-20T18:52:27.248Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.16::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-agent-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1790670439",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.16::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-coredns-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1790670231",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.16::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/subctl-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1790670243",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.16::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-rhel9-operator",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1790670912",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-agent-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788023916",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-coredns-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788023940",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/subctl-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788105072",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-rhel9-operator",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788073481",
                  "versionType": "rpm"
                }
              ]
            }
          ],
          "datePublic": "2026-08-20T17:20:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.9,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1104",
                  "description": "Use of Unmaintained Third Party Components",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-19T17:02:26.651Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2026:63016",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:63016"
            },
            {
              "name": "RHSA-2026:85227",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:85227"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-66788"
            },
            {
              "name": "RHBZ#2507533",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-07-27T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-08-20T17:20:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-1104: Use of Unmaintained Third Party Components"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-66788",
        "datePublished": "2026-08-20T18:15:37.408Z",
        "dateReserved": "2026-07-27T17:51:24.885Z",
        "dateUpdated": "2026-10-19T17:02:26.651Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-66788

Vulnerability from fkie_nvd - Published: 2026-08-20 19:16 - Updated: 2026-10-19 17:17

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:63016
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:85227
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2026-66788
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2507533

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670439",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670231",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/subctl-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670243",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1790670912",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788023916",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788023940",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/subctl-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788105072",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788073481",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una falla en Lighthouse. Un atacante remoto, al comprometer un cl\u00faster spoke, puede explotar una vulnerabilidad donde el espacio de nombres de destino para la inyecci\u00f3n de recursos se deriva de una etiqueta o anotaci\u00f3n controlada por el atacante en el objeto broker. Esto permite al atacante inyectar EndpointSlices y ServiceImports no autorizados en cualquier espacio de nombres en cl\u00fasteres pares, incluyendo espacios de nombres de sistema cr\u00edticos como kube-system y openshift-*. Esto podr\u00eda conducir a una escalada de privilegios u otras formas de compromiso del sistema dentro del cl\u00faster."
    }
  ],
  "id": "CVE-2026-66788",
  "lastModified": "2026-10-19T17:17:21.607",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-66788",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T18:52:23.727449Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T19:16:58.823",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:63016"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:85227"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-66788"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1104"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-264J-8377-4HMM

Vulnerability from github – Published: 2026-08-20 21:31 – Updated: 2026-10-19 18:32

Details

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-66788"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1104",
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-20T19:16:58Z",
    "severity": "CRITICAL"
  },
  "details": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.",
  "id": "GHSA-264j-8377-4hmm",
  "modified": "2026-10-19T18:32:00Z",
  "published": "2026-08-20T21:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66788"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:63016"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:85227"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-66788"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

RHSA-2026:63016

Vulnerability from csaf_redhat - Published: 2026-09-03 04:36 - Updated: 2026-10-21 06:21

Summary

Red Hat Security Advisory: Submariner v0.24 security fixes and container updates

Severity

Important

Scope

13 vulnerabilities in this advisory, including CVE-2026-66788.

CVE-2026-66788

9.9 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Fixed: 16 products Known not affected: 17 products

https://access.redhat.com/errata/RHSA-2026:63016

Open the full advisory

RHSA-2026:85227

Vulnerability from csaf_redhat - Published: 2026-10-19 14:44 - Updated: 2026-10-20 20:12

Summary

Red Hat Security Advisory: Submariner v0.23 security fixes and container updates

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2026-66788.

CVE-2026-66788

9.9 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Fixed: 16 products Known not affected: 17 products

https://access.redhat.com/errata/RHSA-2026:85227

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-66788 (GCVE-0-2026-66788)

FKIE_CVE-2026-66788

GHSA-264J-8377-4HMM

RHSA-2026:63016

RHSA-2026:85227

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour