CVE-2026-66780: Submariner-operator: submariner-operator: flat broker trust model grants every spoke full crud on all endpoints, secrets, and endpointslices in broker namespace
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed?
Joined clusters assigned the submariner-k8s-broker-cluster Role are exposed. A compromise of any such cluster can be used to modify endpoint information for other clusters in the broker namespace.
What level of access does an attacker need?
An attacker needs control of a joined cluster with the excessive broker Role permissions. No user interaction is required, and the described impact includes redirecting inter-cluster tunnel traffic for a mesh-wide MITM attack.
Is a temporary mitigation documented?
The provided information identifies the excessive permissions in the submariner-k8s-broker-cluster Role as the cause, but does not provide a workaround or mitigation for environments that cannot patch immediately.