CVE-2026-66782

Katalog CVE

CVSS 5.8 · Medium EPSS 0,36%

Kerentanan Improper Privilege Management. Skor CVSS 3.1 5.8 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

Rincian

Terbit di NVD

18 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

5.8 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:63016
• https://access.redhat.com/security/cve/CVE-2026-66782
• https://bugzilla.redhat.com/show_bug.cgi?id=2507527