Submariner’s certificate authentication mode builds connection configuration from free‑form strings supplied in the Custom Resource Definition without validation. A malicious cluster can publish a CableName or Subnets value containing newlines and ipsec.conf directives. The injected stanza can override configuration parameters or trigger leftupdown hooks, enabling an attacker to execute arbitrary commands with root privileges on the gateway node. This flaw represents a code injection weakness (CWE‑94) and results in full control of the affected system.

The vulnerability affects installations of the Submariner networking overlay that use the cert‑auth mode. No specific version range is enumerated in the advisory, so all current releases that allow unvalidated CableName and Subnets fields are potentially impacted. The affected components are the Submariner controller running within a Kubernetes cluster and the gateway node that processes the ipsec.conf file.

The vulnerability has a CVSS score of 9.1, indicating critical severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk; a high‑profile exploit remains possible. An attacker that can deploy a malicious CRD in a cluster connected to the target can exploit the flaw simply by publishing the crafted CableName; no additional credentials or privileged access are required beyond cluster membership. Given the remote nature of the attack vector—running in a connected Kubernetes environment—the likelihood of exploitation is considered high as soon as the malicious cluster can reach the target gateway.