CVE-2026-66787 Red Hat CVE debrief

Who should care

Defenders and administrators of Red Hat Advanced Cluster Management for Kubernetes environments should assess exposure and prioritize mitigation to prevent potential MITM attacks. They should review and update configurations to ensure proper validation of IP addresses in EndpointSlice objects, monitor for suspicious traffic indicative of MITM attacks, and verify and apply patches from Red Hat.

Why it matters

CVE-2026-66787 allows a remote attacker to conduct MITM attacks on cross-cluster service communications in Red Hat Advanced Cluster Management for Kubernetes, potentially leading to unauthorized information disclosure and data manipulation. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments using Red Hat Advanced Cluster Management for Kubernetes.

• Potential unauthorized information disclosure due to interception of sensitive data.
• Possible data manipulation through MITM attacks on cross-cluster service communications.
• Required verification of affected versions and remediation steps from Red Hat.
• Necessity for defenders to monitor for suspicious traffic indicative of MITM attacks.

Technical summary

The lighthouse component of Red Hat Advanced Cluster Management for Kubernetes has a flaw due to insufficient validation of advertised IP addresses within EndpointSlice objects. This allows a compromised spoke cluster to create EndpointSlices with attacker-controlled IP addresses, potentially redirecting legitimate service traffic to malicious endpoints. The vulnerability enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments using Red Hat Advanced Cluster Management for Kubernetes.

Recommended defensive actions

• Verify and apply the patch from Red Hat to fix the vulnerability in Red Hat Advanced Cluster Management for Kubernetes.
• Review and update configurations to ensure proper validation of IP addresses in EndpointSlice objects.
• Monitor for suspicious traffic that could indicate MITM attacks on cross-cluster service communications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This allows a compromised spoke cluster to create EndpointSlices with attacker-controlled IP addresses, potentially redirecting legitimate service traffic to malicious endpoints. Defenders should verify and mitigate this vulnerability, especially in environments using Red Hat Advanced Cluster Management for Kubernetes, and monitor for suspicious

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.