Security Flaw in Submariner Operator Exposes Bearer Token Access

CVE-2026-66782

What is CVE-2026-66782?

A vulnerability within the Submariner operator allows attackers to expose a long-lived service account bearer token through the Custom Resource specification. If an attacker gains access to the etcd database or uses kubectl commands to retrieve information, they can obtain this token. Once in possession of the token, an attacker can exert full control over the mesh network, leading to unauthorized management of network resources, including sensitive endpoints and secrets. Users of the Submariner operator must implement immediate precautions to safeguard their environments.

References