CVE-2026-66786

critical · 9.1

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.

9.1

CVSS

1.4%

EPSS (exploit prob.)

72nd

EPSS percentile

2026-09-02

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

References

https://access.redhat.com/errata/RHSA-2026:63016
https://access.redhat.com/errata/RHSA-2026:85227
https://access.redhat.com/security/cve/CVE-2026-66786
https://bugzilla.redhat.com/show_bug.cgi?id=2507531

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-66786