CVE-2026-66787 Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66785 Submariner: ipsec psk secrets file created with default world-readable permissions

A flaw was found in Submariner. This vulnerability allows a malicious cluster spoke to redirect network traffic from other connected clusters peer clusters by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious...

CVE-2026-66785

Submariner is vulnerable to a network subnet validation flaw that allows a malicious connected cluster (spoke) to publish a specially crafted network endpoint declaring arbitrary network ranges . Peer clusters then reroute all traffic destined for those ranges through the attacker's tunnel, poten...

CVE-2026-66788

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66787

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66785

A flaw was found in Submariner. This vulnerability allows a malicious cluster spoke to redirect network traffic from other connected clusters peer clusters by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious...

GO-2026-6165 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, telegraf, spegel, kubo, ipfs-cluster-fips, spegel-fips, livekit-egress, k3s, kubo-fips, rke2-runtime, rke2-runtime-fips...

GO-2026-6163 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, spegel, kubo, ipfs-cluster-fips, spegel-fips, livekit-egress, k3s, stunnerd, kubo-fips, op-geth, rke2-runtime, rke2-runtime-fips...

GO-2026-6099 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, spegel, kubo, ipfs-cluster-fips, spegel-fips, k3s, rke2-runtime, rke2-runtime-fips...

GO-2026-6099 vulnerabilities

Vulnerabilities for packages: kubo, ipfs-cluster, k3s, spegel...

GO-2026-6163 vulnerabilities

Vulnerabilities for packages: kubo, spegel, k3s, ipfs-cluster, op-geth...

GO-2026-6165 vulnerabilities

Vulnerabilities for packages: telegraf, kubo, spegel, k3s, ipfs-cluster...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, cluster-api-ipam-provider-in-cluster, external-secrets-operator, kubescape, metallb, hubble-ui, kuma, rancher-system-agent, kube-state-metrics, node-feature-discovery, cluster-api-provider-vsphere, argocd-image-updater, kubeflow-pipelines,...

EUVD-2026-62918

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

PT-2026-79122

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources CRs to bypass security controls. Th...

PT-2026-79098

Name of the Vulnerable Software and Affected Versions Submariner affected versions not specified Description A flaw allows a malicious spoke cluster to redirect network traffic from connected peer clusters by publishing a specially crafted network endpoint. The system does not properly validate...

PT-2026-79124

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a tenant with HelmRelease create permissions to manipulate the secretRef.Namespace field. This...

PT-2026-79099

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the lighthouse component occurs due to insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spok...

CVE-2026-73137: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-66787: Active Debug Code

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...