| ID |
CVE-2026-66782
|
| Sažetak |
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets. |
| Reference |
|
| CVSS |
| Base: | 5.8 |
| Impact: | 4.0 |
| Exploitability: | 1.3 |
|
| Pristup |
| Vektor | Složenost | Autentikacija |
| NETWORK |
HIGH |
HIGH |
|
| Impact |
| Povjerljivost | Cjelovitost | Dostupnost |
| NONE |
HIGH |
NONE |
|
| CVSS vektor |
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N |
| Zadnje važnije ažuriranje |
03-09-2026 - 13:06 |
| Objavljeno |
18-08-2026 - 17:17 |
