CVE-2026-66786 Red Hat CVE debrief

Who should care

Administrators and users of submariner, especially those using cert-auth mode, should be aware of this critical vulnerability and take immediate action to mitigate the risk. They should verify the affected versions and scope, and implement additional security controls to detect and prevent similar attacks. The vulnerability has a critical CVSS score of 9.1 and requires immediate attention from operators, platform teams, vulnerability management teams, and security teams.

Technical summary

The vulnerability exists in the cert-auth mode of submariner, where the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. This allows a malicious cluster to publish a CableName that includes newlines and ipsec.conf directives, leading to remote code execution as root on the gateway node. The vulnerability has a critical CVSS score of 9.1 and requires immediate attention.

Defensive priority

High priority due to critical CVSS score of 9.1 and potential for remote code execution.

Recommended defensive actions

• Apply patches or updates provided by the vendor to fix the vulnerability.
• Restrict access to the affected system to prevent exploitation.
• Monitor the system for suspicious activity.
• Consider implementing additional security controls to detect and prevent similar attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from the NVD and Red Hat sources indicates a critical vulnerability in submariner. However, details on the affected versions and scope are limited. The vulnerability exists in the cert-auth mode of submariner, where the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. This allows a malicious cluster to publish a CableName that includes newlines and ipsec.conf directives, leading to remote code execution as root on the gateway node. Administrators should verify the affected versions and scope, and take immediate action to mitigate the risk.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.