Medium [CVE-2026-66783] Release workflow consumes same-org composite action via mutable @devel branch ref
This medium-severity Red Hat Linux advisory covers CVE-2026-66783 affecting Red Hat Advanced Cluster Management for Kubernetes 2.17.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path.
This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image. This is due to a lack of image validation when overriding component images, enabling the deployment of malicious images with extensive privileges.
Red Hat severity: Important — CVSS 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N). Weakness: CWE-1357.
Red Hat fixing advisory: RHSA-2026:63016.
Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.17.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
- rhacm2/subctl-rhel9:1788105072
- rhacm2/submariner-rhel9-operator:1788073481
- RHSA-2026:63016
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Mitigation checklist
- To mitigate this issue, restrict access to cluster-admin roles and carefully control permissions for users or service accounts that can modify Submariner Custom Resources. Ensure that only trusted and authorized personnel have the ability to patch Submariner CRs, thereby preventing the injection of malicious images.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.