Low [CVE-2026-66788] Dockerfile build stages use end-of-life Fedora 40 referenced by mutable tag

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object.

This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

Important: This flaw in Red Hat Advanced Cluster Management for Kubernetes allows a compromised spoke cluster to inject EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters, including critical system namespaces.

The `lighthouse-agent` service account uses an attacker-controlled label for the destination namespace without validation, enabling potential privilege escalation or service disruption across the cluster federation. Red Hat severity: Important — CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Weakness: CWE-1104. Red Hat fixing advisory: RHSA-2026:63016.

Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.17.