The Submariner operator stores the IPsec pre‑shared key (PSK) inside the Submariner Custom Resource in plain text. Because the key is not encrypted, any party that gains read access to the CR can obtain the PSK and use it to decrypt traffic between Kubernetes clusters in the mesh, exposing sensitive information from network exchanges. This flaw is a confidentiality violation classified under CWE‑312.

The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes 2, as implemented by the Submariner operator. No specific version numbers are disclosed in the available data.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Since the PSK is stored in the cluster’s configuration, an attacker must have cluster access and read permissions to the Submariner CR. The likely attack vector is an insider or compromised cluster administrator who can extract the PSK and passively decrypt inter‑cluster traffic. Proper RBAC can limit this risk, but in the absence of that, any user with CR visibility can exploit the flaw.