Description
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.
Published: 2026-08-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an attacker who can control a spoke cluster to create EndpointSlice objects with malicious IP addresses. The lighthouse DNS on other clusters then redirects legitimate service traffic to those fake endpoints, enabling a transparent Man‑in‑the‑Middle attack on cross‑cluster communications. This can result in unauthorized data disclosure or manipulation, but does not grant direct code execution. The vulnerability is associated with CWE-345 and CWE-489.

Affected Systems

The vulnerable product is Red Hat Advanced Cluster Management for Kubernetes 2.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector, inferred from the description, is a compromised spoke cluster that can create arbitrary EndpointSlice resources with attacker‑controlled IP addresses without requiring cluster‑wide privileged access.

Generated by OpenCVE AI on September 2, 2026 at 06:42 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Restrict creation of EndpointSlice objects to trusted administrative roles and enforce strict validation of advertised IP addresses to prevent spoofing
  • Disable or limit the lighthouse DNS service on clusters that do not require cross‑cluster service discovery until a vendor patch is available
  • Apply a vendor update or install a later release of Red Hat Advanced Cluster Management for Kubernetes 2 when the fix is released

Generated by OpenCVE AI on September 2, 2026 at 06:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2 cpe:/a:redhat:acm:2.17::el9
References

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Title Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice and serviceimport ips Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082
Weaknesses CWE-489
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Management For Kubernetes
Vendors & Products Redhat advanced Cluster Management For Kubernetes

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.
Title Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice and serviceimport ips
First Time appeared Redhat
Redhat acm
Weaknesses CWE-345
CPEs cpe:/a:redhat:acm:2
Vendors & Products Redhat
Redhat acm
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Redhat Acm Advanced Cluster Management For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-03T04:41:35.217Z

Reserved: 2026-07-27T17:51:24.885Z

Link: CVE-2026-66787

cve-icon Vulnrichment

Updated: 2026-08-20T18:52:14.761Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-20T19:16:58.637

Modified: 2026-09-03T13:06:01.073

Link: CVE-2026-66787

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-20T17:20:00Z

Links: CVE-2026-66787 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T06:45:05Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-489

    Active Debug Code