CVE-2026-66782
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A flaw in the Submariner operator allows exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token, granting full control over the mesh network and enabling unauthorized management of network resources such as endpoints and secrets.
Risk Assessment
Token exposure can lead to full control over the mesh network, allowing an attacker to manipulate traffic and access sensitive data.
Recommendation
Restrict access to the cluster and etcd database, regularly rotate service account tokens, and apply vendor patches.
Original NVD description (English source)
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.