rhacm2/subctl-rhel9 vulnerabilities
CVEs whose affected-version data names the rhacm2/subctl-rhel9 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-66786Critical· 9.1A flaw was found in submariner
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a Ca…
CVE-2026-66787High· 8.7A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluste…
CVE-2026-66788Critical· 9.9A flaw was found in Lighthouse
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the brok…
CVE-2026-66781Medium· 5.4Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communi…
CVE-2026-66782Medium· 5.8Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the clu…
CVE-2026-66783Medium· 4.4Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR),…
CVE-2026-66780Medium· 6.5A flaw was found in the submariner-operator component
A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, sp…