CVE-2026-66782: Token Exposure in Submariner Operator

A vulnerability identified as CVE-2026-66782 affects the Submariner operator by improperly exposing a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. This flaw poses a significant risk to Kubernetes environments utilizing Submariner for cross-cluster networking. By design, the operator stores sensitive authentication material in a location that is accessible to any entity with sufficient RBAC permissions to inspect Custom Resources. An attacker who has gained initial access to a cluster and holds permissions to execute kubectl get commands, or one who gains unauthorized access to the underlying etcd database, can extract this token. Possession of this bearer token effectively allows an attacker to impersonate the broker service account, granting them administrative control over the mesh network, including the ability to manage network endpoints and access stored secrets.

Impact

The successful exploitation of this vulnerability results in full administrative control over the Submariner mesh network. This enables unauthorized actors to intercept traffic, modify network topology, gain access to sensitive cross-cluster secrets, and manipulate network endpoints. This compromise is particularly critical in multi-cluster environments where the broker service account possesses wide-ranging permissions across the mesh.

Recommendation

1. Audit current Kubernetes RBAC configurations to ensure the principle of least privilege is applied to Custom Resource access, specifically for the Submariner operator resources.
2. Implement monitoring for anomalous kubectl get requests directed at Submariner-related Custom Resources.
3. Rotate the Submariner broker service account token immediately following the application of security patches.
4. Ensure the Submariner operator is updated to the latest version as provided by the vendor to remediate the inclusion of the token in the CR specification.