Bug 2507532 (CVE-2026-66787)

Summary:	CVE-2026-66787 lighthouse: Go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	gparvin, rhaigner, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-27 15:44:45 UTC

There is no validation that advertised IPs in EndpointSlice objects fall within the source cluster's allocated Pod/Service/Globalnet CIDR, nor that they are not link-local, loopback, or the importing cluster's own control-plane addresses. A compromised spoke can create an EndpointSlice with attacker-controlled IP addresses for any service name, causing peer clusters' lighthouse DNS to resolve legitimate service names to malicious endpoints. This enables transparent MITM of cross-cluster service traffic without modifying the target service.

Source: Project Glasswing AI-SAST audit of submariner-io/lighthouse.
Finding ID: FIND-001
Assurance: execution_proven