Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T17:20:00 lighthouse: Go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CWE-489

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

This Important vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows a compromised spoke cluster to perform cross-cluster DNS spoofing. By creating unvalidated EndpointSlice objects with attacker-controlled IP addresses, a malicious actor can redirect legitimate service traffic between clusters, enabling transparent Man-in-the-Middle attacks without altering the target service. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/lighthouse-agent-rhel9:1788023916 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/lighthouse-coredns-rhel9:1788023940 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/subctl-rhel9:1788105072 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/submariner-rhel9-operator:1788073481 https://www.cve.org/CVERecord?id=CVE-2026-66787 https://nvd.nist.gov/vuln/detail/CVE-2026-66787