Bug 2507531 (CVE-2026-66786)

Summary:	CVE-2026-66786 submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and Subnets
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gparvin, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 15:44:40 UTC

In cert-auth mode the connection stanza is built with fmt.Sprintf and written to submariner.conf. Spec.CableName and Spec.Subnets are free-form strings in the CRD with no pattern validation. A malicious cluster can publish a CableName containing newlines and ipsec.conf directives (e.g. authby=never, rightsubnet=0.0.0.0/0, leftupdown=/bin/sh) to inject arbitrary stanza parameters or execute commands via leftupdown hooks. This enables remote code execution as root on the gateway node.

Source: Project Glasswing AI-SAST audit of submariner-io/submariner.
Finding ID: FIND-005
Assurance: machine_verified