{"id":"CVE-2026-66781","revision":"b908c9cdf502448287d30def39c85b1c","records":[{"revision":"b908c9cdf502448287d30def39c85b1c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-66781","aliases":[],"title":"Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication","description":"A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.","state":0,"publishedAt":"2026-08-18T17:05:52.128+00:00","modifiedAt":"2026-10-19T17:02:09.726+00:00","affected":[{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-addon-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.11\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-addon-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1787689013\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.11::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-addon-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.13\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-addon-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1787365971\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.13::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-addon-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.14\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-addon-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1787362756\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.14::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-addon-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.15\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-addon-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1787362733\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.15::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-addon-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.16\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-addon-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1787362694\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.16::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/subctl-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.16\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/subctl-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1790670243\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.16::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.16\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1790670912\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.16::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-addon-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.17\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-addon-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1787362658\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.17::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/subctl-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.17\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/subctl-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1788105072\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.17::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhacm2/submariner-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.17\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhacm2/submariner-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1788073481\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2.17::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/submariner-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/submariner-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","score":5.4,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:85227","https://access.redhat.com/security/cve/CVE-2026-66781","https://bugzilla.redhat.com/show_bug.cgi?id=2507526"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-66781","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-66781","identifiers":["CVE-2026-66781"]},"retained":false,"historicalAffected":[]}],"coverage":[]}