Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T17:20:00 lighthouse: Dockerfile build stages use end-of-life Fedora 40 referenced by mutable tag 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-1104

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.

Important: This flaw in Red Hat Advanced Cluster Management for Kubernetes allows a compromised spoke cluster to inject EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters, including critical system namespaces. The `lighthouse-agent` service account uses an attacker-controlled label for the destination namespace without validation, enabling potential privilege escalation or service disruption across the cluster federation. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/lighthouse-agent-rhel9:1788023916 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/lighthouse-coredns-rhel9:1788023940 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/subctl-rhel9:1788105072 Red Hat Advanced Cluster Management for Kubernetes 2.17 2026-09-03T00:00:00Z RHSA-2026:63016 rhacm2/submariner-rhel9-operator:1788073481 https://www.cve.org/CVERecord?id=CVE-2026-66788 https://nvd.nist.gov/vuln/detail/CVE-2026-66788