CVE-2026-66783: Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.
Other sources
GetImagePath returns imageOverrides[component] verbatim with zero validation — no registry allow-list, no digest requirement, no signature check. The resulting image runs with Privileged: true, Capabilities: ALL, hostNetwork, RW hostPath mounts, on every node (route-agent) including control-plane nodes. A cluster-admin or anyone who can patch the Submariner CR can point any component to a malicious image and achieve privileged code execution across the entire cluster.
Source: Project Glasswing AI-SAST audit of submariner-io/submariner-operator. Finding ID: FIND-006 Assurance: machineverified
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Clusters are exposed when a cluster administrator or another user can modify the Submariner Custom Resource. The issue is local (AV:L) and requires high privileges (PR:H), so an unauthenticated remote attacker is not described by the available data.
What does an attacker need to do to exploit it?
An attacker needs permission to modify the Submariner CR and must provide a malicious image path. The operator does not validate that path, allowing deployment of the attacker-controlled image.
What is the likely impact of successful exploitation?
Successful exploitation can execute arbitrary code with elevated privileges throughout the cluster, including on control-plane nodes. The stated impact includes high confidentiality, integrity, and availability effects.