« Volver al listado

CVE-2026-66788

Estado: Pendiente de análisisBaja (3.7)—

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Lighthouse — LighthouseAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-66788",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-66788",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-20T18:52:23.727449Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1788023916",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/lighthouse-agent-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1788023940",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/lighthouse-coredns-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1788105072",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/subctl-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:acm:2.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1788073481",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhacm2/submariner-rhel9-operator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-20T19:16:58.823",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:63016",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-66788",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507533",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1104"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster."
    }
  ],
  "lastModified": "2026-09-03T13:06:01.203",
  "sourceIdentifier": "secalert@redhat.com"
}