Red Hat Advanced Cluster Management Lighthouse Component DNS Hijacking

CVE-2026-66787 is a security flaw identified in the lighthouse component of Red Hat Advanced Cluster Management (RHACM) for Kubernetes. The vulnerability arises from inadequate validation of advertised IP addresses within Kubernetes EndpointSlice objects. An attacker who has already compromised a spoke cluster can leverage this flaw by injecting manipulated EndpointSlices containing attacker-controlled IP addresses. The lighthouse controller, responsible for cross-cluster service discovery, processes these objects and propagates the malicious information to other clusters. This allows the attacker to hijack DNS resolution for cross-cluster service traffic, effectively transparently redirecting legitimate service requests to malicious infrastructure under their control. This vulnerability poses a significant risk to the integrity and confidentiality of cross-cluster communications, potentially enabling unauthorized information disclosure and data manipulation within a multi-cluster Kubernetes environment.

Impact

The vulnerability facilitates Man-in-the-Middle (MITM) attacks on internal cross-cluster service traffic. Successful exploitation could lead to the interception of sensitive data, authentication credentials, or other information exchanged between microservices across different clusters. An attacker could also conduct data manipulation or denial-of-service attacks by rerouting service traffic to unintended destinations. The scope of impact is limited to Kubernetes environments utilizing the RHACM lighthouse component for cross-cluster connectivity.

Recommendation

Prioritize the identification and monitoring of EndpointSlice creation events within the cluster. Focus on auditing cross-cluster service discovery configurations managed by the lighthouse component. Apply the latest security patches provided by Red Hat to address the validation logic flaw in the lighthouse service. Monitor Kubernetes API server logs for anomalous modifications to EndpointSlice resources originating from spoke cluster namespaces.