Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses
Summary
| CVE | CVE-2026-66787 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-20 19:16:58 UTC |
| Updated | 2026-10-19 17:17:21 UTC |
| Description | A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation. |
Risk And Classification
Primary CVSS: v3.1 8.7 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
EPSS: 0.002950000 probability, percentile 0.208010000 (date 2026-10-19)
Problem Types: CWE-345 | CWE-345 Insufficient Verification of Data Authenticity
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.7 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 8.7 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1790670439 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1790670231 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1790670243 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1790670912 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.17 | unaffected 1788023916 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.17 | unaffected 1788023940 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.17 | unaffected 1788105072 * rpm | Not specified |
| CNA | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.17 | unaffected 1788073481 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-66787 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:63016 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:85227 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-27T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-08-20T17:20:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
There are currently no legacy QID mappings associated with this CVE.