Bug 2507530 (CVE-2026-66785)

Summary:	CVE-2026-66785 submariner: IPsec PSK secrets file created with default world-readable permissions
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 15:44:34 UTC

The broker-to-local sync hook shouldSyncRemoteEndpoint only rejects a remote Endpoint if its subnets overlap the local cluster's own subnets. It does not verify that Spec.ClusterID matches the broker SA that created the CR, that Spec.Subnets are within the CIDRs declared in that cluster's Cluster CR, or that Spec.Subnets do not overlap other remote clusters' subnets. The accepted subnets are installed verbatim as WireGuard AllowedIPs and as Libreswan --client rightSubnet. A malicious spoke can publish an Endpoint with subnets covering arbitrary CIDRs (including 10.0.0.0/8 or 0.0.0.0/0), causing all matching traffic from peer clusters to be routed into the attacker's tunnel.

Source: Project Glasswing AI-SAST audit of submariner-io/submariner.
Finding ID: FIND-004
Assurance: execution_proven