CVE-2026-66787

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66788

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66788 Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66788 Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

EUVD-2026-63535

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66788

A vulnerability in Lighthouse allows a remote attacker who has compromised a spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters. The root cause is that the destination namespace for resource injection is derived from an attacker-controlled l...

CVE-2026-66787 Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

EUVD-2026-63533

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66787 Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66787

A flaw in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes allows for cross-cluster DNS spoofing . The vulnerability is caused by insufficient validation of advertised IP addresses within EndpointSlice objects . An attacker who has compromised a spoke cluster can cre...

CVE-2026-66788

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66787

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66788: Use of Unmaintained Third Party Components

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66787: Insufficient Verification of Data Authenticity

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

PT-2026-79099

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the lighthouse component occurs due to insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spok...

PT-2026-79100

Name of the Vulnerable Software and Affected Versions Lighthouse affected versions not specified Description A flaw allows a remote attacker who has compromised a spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters. This occurs because the...

CVE-2026-73264

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2026-73264 Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2026-73264 Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated baseurl for the openaicompatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2026-73264

Prowler (cloud security platform) contains an SSRF risk prior to version 5.33.1. An authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider via POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/...