Lighthouse Cross-Namespace Resource Injection Vulnerability

A critical security vulnerability (CVE-2026-66788) exists in Submariner Lighthouse, a multi-cluster service discovery tool. The flaw allows an attacker who has successfully compromised a spoke cluster to exploit the resource injection mechanism. The vulnerability occurs because the destination namespace for resource injection is determined by an attacker-controlled label or annotation on the broker object rather than being validated against allowed scopes. By manipulating these labels or annotations, an attacker can force the injection of unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters, including sensitive system namespaces such as kube-system and openshift-*. This flaw enables cross-namespace unauthorized resource creation, effectively allowing an attacker to hijack service traffic or escalate privileges across the connected cluster network. Given the CVSS score of 9.9, this vulnerability poses a significant risk to the integrity and security of multi-cluster environments managed by Submariner.

Impact

Successful exploitation allows attackers to perform cross-namespace resource injection in a multi-cluster environment. This can result in unauthorized service discovery, traffic interception, or privilege escalation by deploying malicious service definitions into critical system namespaces. The scope of impact includes any infrastructure using Submariner Lighthouse for cross-cluster service discovery.

Recommendation

Prioritized actions for security teams managing Submariner Lighthouse:

• Upgrade Submariner Lighthouse to the patched version that implements validation for namespace-related labels and annotations on broker objects.
• Audit existing Kubernetes RBAC configurations and Submariner broker permissions to ensure that compromised spoke clusters do not have excessive write permissions to the broker object's metadata.
• Monitor logs for unusual modifications to EndpointSlice or ServiceImport resources originating from external clusters.