A flaw in the Submariner component allows a malicious cluster to redirect traffic from peer clusters by creating a fake network endpoint with an arbitrary subnet description. The Submariner service fails to validate the endpoint.spec.subnets field, so the attacker’s endpoint can declare any IP ranges, causing all traffic intended for those ranges to be tunneled through the attacker’s wireguard/IPsec connection. This leads to unauthorized retrieval of data or disruption of legitimate network flow between clusters.

The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes version 2. No additional vendor product or specific minor versions are listed, so all installations of the 2.x series are potentially impacted until the fix is applied.

The CVSS score of 9.9 reflects a critical threat with remote network‑level impact. The EPSS score is not available, which does not provide an exploitation probability estimate, but the absence of a KEV listing does not diminish the seriousness; the flaw permits traffic hijack whenever an attacker can create a malicious endpoint, typically from a compromised or rogue spoke cluster. Nodes connected via Submariner that trust the endpoint source are vulnerable to having their traffic redirected without local detection, making this threat high risk for environments with multiple inter‑cluster connections.