Description
A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.
Published: 2026-08-18
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Submariner operator stores the IPsec pre‑shared key inside the Submariner Custom Resource in plain text. Because this key is not encrypted, any party that can read the Custom Resource can obtain the PSK and use it to decrypt traffic flowing between Kubernetes clusters in the mesh, exposing sensitive information from inter‑cluster communication. This flaw violates confidentiality and is classified under CWE-312 and CWE-749.

Affected Systems

The vulnerability impacts Red Hat Advanced Cluster Management for Kubernetes 2 and all subsequent releases 2.11, 2.13, 2.14, 2.15, 2.16, and 2.17, which are distributed via the Submariner operator. These versions are identified by the matching CPE strings and errata references.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis, and it is not listed in the CISA KEV catalog. Exploitation requires cluster access with read permissions to the Submariner Custom Resource, so the likely attack vector is an insider or a compromised cluster administrator able to extract the PSK and passively decrypt inter‑cluster traffic. Proper RBAC can limit this risk by restricting visibility of the Custom Resource.

Generated by OpenCVE AI on September 2, 2026 at 07:51 UTC.

Remediation

Vendor Workaround

To mitigate the risk of IPsec pre-shared key (PSK) disclosure, implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit access to Submariner Custom Resources. Ensure that only authorized administrators and systems are granted permissions to view `submariner` Custom Resources within their namespaces. Additionally, exercise caution when collecting and storing diagnostic data, such as must-gather bundles, and when managing GitOps repositories, as these may inadvertently expose the cleartext PSK.

OpenCVE Recommended Actions

  • Enforce strict Kubernetes RBAC so that only authorized administrators or systems can view Submariner Custom Resources.
  • Restrict the collection of diagnostic bundles (must‑gather) and GitOps repositories that may expose the cleartext PSK.
  • Apply any available patch or update to the Submariner operator that secures the PSK storage.

Generated by OpenCVE AI on September 2, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
References

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Title Submariner-operator: submariner-operator: ipsec psk stored cleartext in submariner cr spec Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
Weaknesses CWE-749
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Thu, 27 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.14::el9
cpe:/a:redhat:acm:2.16::el9
References

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:acm:2.15::el9
cpe:/a:redhat:acm:2.17::el9
References

Fri, 21 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 18 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.
Title Submariner-operator: submariner-operator: ipsec psk stored cleartext in submariner cr spec
First Time appeared Redhat
Redhat acm
Weaknesses CWE-312
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-05T14:23:31.630Z

Reserved: 2026-07-27T17:51:24.885Z

Link: CVE-2026-66781

cve-icon Vulnrichment

Updated: 2026-08-18T19:21:39.912Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T17:17:00.580

Modified: 2026-09-03T13:06:00.327

Link: CVE-2026-66781

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-18T16:35:00Z

Links: CVE-2026-66781 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T08:00:14Z

Weaknesses
  • CWE-312

    Cleartext Storage of Sensitive Information

  • CWE-749

    Exposed Dangerous Method or Function