CVE-2026-66788

Full vulnerability record from the local CVENow database.
Description

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.
Severity
CRITICAL
CVSS score
9.9 (v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
[email protected]
Published
2026-08-20 19:16:58.823000
Last modified
2026-10-19 17:17:21.607000
View original CVE JSON
{
  "id": "CVE-2026-66788",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-20T19:16:58.823",
  "lastModified": "2026-10-19T17:17:21.607",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en Lighthouse. Un atacante remoto, al comprometer un clúster spoke, puede explotar una vulnerabilidad donde el espacio de nombres de destino para la inyección de recursos se deriva de una etiqueta o anotación controlada por el atacante en el objeto broker. Esto permite al atacante inyectar EndpointSlices y ServiceImports no autorizados en cualquier espacio de nombres en clústeres pares, incluyendo espacios de nombres de sistema críticos como kube-system y openshift-*. Esto podría conducir a una escalada de privilegios u otras formas de compromiso del sistema dentro del clúster."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "versions": [
            {
              "version": "1790670439",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "versions": [
            {
              "version": "1790670231",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/subctl-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "versions": [
            {
              "version": "1790670243",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "cpes": [
            "cpe:/a:redhat:acm:2.16::el9"
          ],
          "versions": [
            {
              "version": "1790670912",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "versions": [
            {
              "version": "1788023916",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "versions": [
            {
              "version": "1788023940",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/subctl-rhel9",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "versions": [
            {
              "version": "1788105072",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "defaultStatus": "affected",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "packageName": "rhacm2/submariner-rhel9-operator",
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "versions": [
            {
              "version": "1788073481",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-20T18:52:23.727449Z",
          "id": "CVE-2026-66788",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1104"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:63016",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:85227",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-66788",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533",
      "source": "[email protected]"
    }
  ]
}