{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/submariner/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-66788"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Lighthouse"],"_cs_severities":["critical"],"_cs_tags":["cloud-native","kubernetes","privilege-escalation","submariner"],"_cs_type":"advisory","_cs_vendors":["Submariner"],"content_html":"\u003cp\u003eA critical security vulnerability (CVE-2026-66788) exists in Submariner Lighthouse, a multi-cluster service discovery tool. The flaw allows an attacker who has successfully compromised a spoke cluster to exploit the resource injection mechanism. The vulnerability occurs because the destination namespace for resource injection is determined by an attacker-controlled label or annotation on the broker object rather than being validated against allowed scopes. By manipulating these labels or annotations, an attacker can force the injection of unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters, including sensitive system namespaces such as kube-system and openshift-*. This flaw enables cross-namespace unauthorized resource creation, effectively allowing an attacker to hijack service traffic or escalate privileges across the connected cluster network. Given the CVSS score of 9.9, this vulnerability poses a significant risk to the integrity and security of multi-cluster environments managed by Submariner.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to perform cross-namespace resource injection in a multi-cluster environment. This can result in unauthorized service discovery, traffic interception, or privilege escalation by deploying malicious service definitions into critical system namespaces. The scope of impact includes any infrastructure using Submariner Lighthouse for cross-cluster service discovery.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams managing Submariner Lighthouse:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Submariner Lighthouse to the patched version that implements validation for namespace-related labels and annotations on broker objects.\u003c/li\u003e\n\u003cli\u003eAudit existing Kubernetes RBAC configurations and Submariner broker permissions to ensure that compromised spoke clusters do not have excessive write permissions to the broker object's metadata.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual modifications to EndpointSlice or ServiceImport resources originating from external clusters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T21:19:07Z","date_published":"2026-08-20T21:19:07Z","id":"https://feed.craftedsignal.io/briefs/2026-08-lighthouse-vulnerability/","summary":"A vulnerability in Submariner Lighthouse allows a compromised spoke cluster to inject unauthorized EndpointSlices and ServiceImports into peer cluster namespaces, leading to potential privilege escalation.","title":"Lighthouse Cross-Namespace Resource Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-08-lighthouse-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Submariner","version":"https://jsonfeed.org/version/1.1"}