CVE-2026-66787

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

Score
CVSS 3.1 8.7 High
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-08-20
Last modified
2026-10-19
Weaknesses
CWE-345

Affected products

References

 
 
© AVABIS GmbH privacypolicy about