THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-66786 (CRITICAL 9.1) — A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.co

[NVD] CVE-2026-66786 (CRITICAL 9.1) — A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.co

mednvdPublished 2026-09-02

CVE-2026-66786 CVSS: 9.1 CRITICAL Published: 2026-09-02T18:21:10.517

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject a

Indicators of compromise

CVE-2026-66786cve
ipsec.codomain

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-66786