{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/submariner-operator/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-66782"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Submariner operator"],"_cs_severities":["high"],"_cs_tags":["credential-access","kubernetes","cloud-native"],"_cs_type":"threat","_cs_vendors":["Submariner"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-66782 affects the Submariner operator by improperly exposing a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. This flaw poses a significant risk to Kubernetes environments utilizing Submariner for cross-cluster networking. By design, the operator stores sensitive authentication material in a location that is accessible to any entity with sufficient RBAC permissions to inspect Custom Resources. An attacker who has gained initial access to a cluster and holds permissions to execute \u003ccode\u003ekubectl get\u003c/code\u003e commands, or one who gains unauthorized access to the underlying etcd database, can extract this token. Possession of this bearer token effectively allows an attacker to impersonate the broker service account, granting them administrative control over the mesh network, including the ability to manage network endpoints and access stored secrets.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this vulnerability results in full administrative control over the Submariner mesh network. This enables unauthorized actors to intercept traffic, modify network topology, gain access to sensitive cross-cluster secrets, and manipulate network endpoints. This compromise is particularly critical in multi-cluster environments where the broker service account possesses wide-ranging permissions across the mesh.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit current Kubernetes RBAC configurations to ensure the principle of least privilege is applied to Custom Resource access, specifically for the Submariner operator resources.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for anomalous \u003ccode\u003ekubectl get\u003c/code\u003e requests directed at Submariner-related Custom Resources.\u003c/li\u003e\n\u003cli\u003eRotate the Submariner broker service account token immediately following the application of security patches.\u003c/li\u003e\n\u003cli\u003eEnsure the Submariner operator is updated to the latest version as provided by the vendor to remediate the inclusion of the token in the CR specification.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-18T18:55:53Z","date_published":"2026-08-18T18:55:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-submariner-token-exposure/","summary":"The Submariner operator exposes long-lived service account tokens within Custom Resource specifications, allowing attackers with RBAC access to gain full control over mesh network resources.","title":"CVE-2026-66782: Token Exposure in Submariner Operator","url":"https://feed.craftedsignal.io/briefs/2026-08-submariner-token-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Submariner Operator","version":"https://jsonfeed.org/version/1.1"}