---
id: CVE-2026-66786
title: A flaw was found in submariner
summary: >-
  A flaw was found in submariner. In cert-auth mode, the connection
  configuration is built using free-form strings from the Custom Resource
  Definition (CRD) without proper validation. A malicious cluster can exploit
  this by publishing a Ca…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-94
published: '2026-09-02'
updated: '2026-09-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66786'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:63016'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-66786'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507531'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:85227'
    label: 'RHSA-2026:85227'
tags:
  - nvd
  - cve.org
epss: 0.01372
epssPercentile: 0.71807
ingestedAt: '2026-09-05T20:44:35.324Z'
vendor: Red Hat
product: rhacm2/lighthouse-agent-rhel9
affected:
  - rhacm2/lighthouse-agent-rhel9 (all versions)
  - rhacm2/lighthouse-coredns-rhel9 (all versions)
  - rhacm2/subctl-rhel9 (all versions)
  - rhacm2/submariner-gateway-rhel9 (all versions)
  - rhacm2/submariner-globalnet-rhel9 (all versions)
  - rhacm2/submariner-rhel9-operator (all versions)
  - rhacm2/submariner-route-agent-rhel9 (all versions)
  - rhacm2/lighthouse-agent-rhel9 (all versions)
  - rhacm2/lighthouse-coredns-rhel9 (all versions)
  - rhacm2/subctl-rhel9 (all versions)
  - rhacm2/submariner-gateway-rhel9 (all versions)
  - rhacm2/submariner-globalnet-rhel9 (all versions)
  - rhacm2/submariner-rhel9-operator (all versions)
  - rhacm2/submariner-route-agent-rhel9 (all versions)
  - rhacm2/submariner-addon-rhel9 (all versions)
  - rhacm2/submariner-operator-bundle (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-05T01:01:16.851937Z'
---

## Overview

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.