RHSA-2026:85227HighCVSS 9.9

Red Hat Security Advisory: Submariner v0.23 security fixes and container updates

Published
October 19, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (11)

CVE-2026-32936 →CVE-2026-35579 →CVE-2026-66780 →CVE-2026-66781 →CVE-2026-66786 →CVE-2026-66787 →CVE-2026-63209 →CVE-2026-66782 →CVE-2026-66783 →CVE-2026-66785 →CVE-2026-66788 →

📋 Description

CVE-2026-32936 — github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests CVE-2026-35579 — github.com/coredns/coredns: CoreDNS: Authentication bypass allows unauthorized access to TSIG-protected functionalities CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-66780 — submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity CVE-2026-66781 — submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication CVE-2026-66782 — submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps CVE-2026-66783 — submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch ref CVE-2026-66785 — submariner: submariner: missing validation of remote Endpoint subnets and ClusterID enables cross-cluster traffic hijack CVE-2026-66786 — submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and Subnets CVE-2026-66787 — lighthouse: lighthouse: cross-cluster DNS spoofing via unvalidated EndpointSlice IP addresses CVE-2026-66788 — lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

🎯 Affected products34

  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:241a516da7c2ba28a0cb11406b59623441236cf8471e738607401e7c89e4c5e6_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:2ee611bc2815a0c448a6c9c0294f9bcd390ad0efdb9e640e8ab737b2c88c977e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:3d88ee2952c25a1f6cf90139a93c638b3da521cabe42673a33d3f98d0e65295f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-agent-rhel9@sha256:661cd04c8903a5922077419a8c053245fa34b5ab6cc2b6d726f79e2617c8df4c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:3421981d830213b259bfe4ece406c3c1f42b83a3be85ac0998a1db4b991cd813_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:ab74781f9851008e7f36ea50355ec568b65593344cb54c65c14f1ef0ba6775ad_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:b48ad109ba57e8fa189026b634ddb92d01372d65b43fcd3c56088434629aff57_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/lighthouse-coredns-rhel9@sha256:c6ba7466a13caaa9649677de1b4ba8e102b31df8ca81225e65278ef4f4113b96_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:4864356778d0f7d8e92a181ee6b3ea30a116bcfb122cf27dc651876650069542_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:9df9c0591d70483e44d5aa2cf0730c274013cf6e12e96df43ab13f42c6c12bca_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:a94c673a2e518229d432390be2422a9c329af8d10e62a43661fbeceea45be8b6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/nettest-rhel9@sha256:aabb16573e48619f11fc94d51ba3bde8d65f0c76656110f7b8cb8b92142b69db_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:041d41181e65723b8f613ee3126b2f76c0ab0d2adee4b693bf36e3c97a71e23b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:56a0e878de0a60cb9283fb02edbdbd00521ccd889a537bc36ea6d9dcebebd886_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:7c6bc085b5a0a0b41ed2d5e9eade2f82ad83930299d3069e26c04f59799ceedc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/subctl-rhel9@sha256:9dfc73b384deff402db82cfcc2f1c4a4feb23066f1dea5434dc7c9fd2537fdf4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:23d20d6d39a0f4e4afa8f0e80bc67125e8a24f7bf6e8a6121e24010cbaaf54a7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:4cd809f0f7ea9751f671c2078a44c6d2a64fd6664e9ceea08627ea0cffad0f53_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:9fa79d5d71b6be814b74b63483dc749571607f8f33e1af7cb0b163a0f6b6c697_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-gateway-rhel9@sha256:ededbd278919ccb6711fd549ca1c83ad650a817537aa529fd846627a8a014f70_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:4096c1810d60a84b77741e4a46af9ce83f1774eb8480fd2ea2732225f3d7a64b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:4db95a0ca613b9c81b204ddea41cadd085dc7ab6433626c3a108b46b135d2187_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:8baf942b7122761101fdf010e938d2e89bc131a659196204ab5fd37357db7676_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-globalnet-rhel9@sha256:bdc73680ee251662b5881b624b430f6f4a8be0010b1027977b507407c8068d30_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-operator-bundle@sha256:b83d0f0f158e8b7ad1fc749f2a2b69de30aac8b1b7ca0a62ad19b1b0e9359960_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:2c155bfa256f1efe37d540482faa2a20893badeb493fb739b3281c60a2c5b304_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:52cf97cc4f9357fc4dc08058d255dd65dc4c4d0a23b6f7a9c94d158185630d73_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:81980c7938c5a3e301468a8232cf9955443da594d1d9791e5a079d37dcf5a4ef_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/submariner-rhel9-operator@sha256:ee7b4b6a54ba531e1d17b89b1c929865de4763c6b8c6bd59da0f4684953e9cd4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • +4 more not shown

✅ Remediation

For release note details, see the upstream Submariner release notes: https://submariner.io/community/releases/ Downstream-specific issues resolved: * ACM-34110 * ACM-34588 * ACM-28591 * ACM-34578 * ACM-40464 * ACM-38424 * ACM-38427 * ACM-38429 * ACM-38430 * ACM-38431 * ACM-38434 * ACM-38439 * ACM-38467 * ACM-38468 * ACM-38469 * ACM-38472 * ACM-38475 * ACM-38477 * ACM-38479 * ACM-38516 * ACM-38518 * ACM-38525 * ACM-38526 * ACM-38532 * ACM-38539 * ACM-38541 * ACM-38545 * ACM-47362 * ACM-38306 * ACM-38318 * ACM-38331 * ACM-38336 * ACM-38358 * ACM-38363 * ACM-38317 * ACM-38329 * ACM-38354 * ACM-38433 * ACM-38489 * ACM-38294 * ACM-38296 * ACM-38293 For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate the risk of IPsec pre-shared key (PSK) disclosure, implement strict Kubernetes Role-Based Access Control (RBAC) policies to limit access to Submariner Custom Resources. Ensure that only authorized administrators and systems are granted permissions to view `submariner` Custom Resources within their namespaces. Additionally, exercise caution when collecting and storing diagnostic data, such as must-gather bundles, and when managing GitOps repositories, as these may inadvertently expose the cleartext PSK. Workaround: To mitigate this issue, ensure that access to Submariner Custom Resources (CRs) is strictly controlled. Implement Kubernetes Role-Based Access Control (RBAC) policies to limit read access to Submariner CRs only to authorized administrators and components that explicitly require it. This reduces the risk of unauthorized disclosure of the broker Service Account bearer token, which may be stored in cleartext within the CR's specification field. Review existing RBAC configurations to ensure least privilege is applied to resources containing sensitive information. Workaround: To mitigate this issue, restrict access to cluster-admin roles and carefully control permissions for users or service accounts that can modify Submariner Custom Resources. Ensure that only trusted and authorized personnel have the ability to patch Submariner CRs, thereby preventing the injection of malicious images. Workaround: If Submariner certificate-based IPsec authentication mode is enabled (`IPSecCertAuthMode: true` in the SubmarinerConfig), administrators can mitigate this flaw by switching to the default pre-shared key (PSK) authentication mode. Set `IPSecCertAuthMode: false` (or remove the field to use its default value) in the SubmarinerConfig CR and redeploy the Submariner gateway pods. PSK mode provides equivalent inter-cluster IPsec tunnel encryption and is not affected by this vulnerability. Note that disabling cert-auth mode means Submariner will no longer integrate with OVN IPsec's certificate infrastructure and will manage its own PSK-based authentication independently.

🔗 References (14)