{"apiVersion":"1.0","identifier":"CVE-2026-66780","description":"A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters- endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.","publishedAt":"2026-08-18T18:19:23","lastModifiedAt":"2026-08-27T04:16:45","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-66780","cvssScore":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00303,"riskScore":1.02,"affectedProduct":"submariner-operator","affectedVersions":"unknown","vulnerabilityType":"Other","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-66780","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-66780","en":"https://www.redsauce.net/en/cves/CVE-2026-66780","fr":"https://www.redsauce.net/fr/cves/CVE-2026-66780","pt":"https://www.redsauce.net/pt/cves/CVE-2026-66780","de":"https://www.redsauce.net/de/cves/CVE-2026-66780","sk":"https://www.redsauce.net/sk/cves/CVE-2026-66780","el":"https://www.redsauce.net/el/cves/CVE-2026-66780"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-66780"}}