Resource Injection Vulnerability in Lighthouse by Red Hat
CVE-2026-66788

9.9CRITICAL

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Management For Kubernetes 2
Vendor
CVE Published:
20 August 2026

What is CVE-2026-66788?

A flaw exists in Lighthouse that allows remote attackers to exploit a vulnerability through resource injections. By manipulating a spoke cluster and exploiting this flaw, attackers can control the destination namespace when injecting resource labels or annotations on the broker object. This intrusion enables the unauthorized creation of EndpointSlices and ServiceImports across any peer cluster namespace, notably within critical system namespaces such as kube-system and openshift-*. The potential consequences include privilege escalation and comprehensive system compromise within the affected cluster.

References

https://access.redhat.com/security/cve/CVE-2026-66788
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2507533
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.