The destination namespace in the local cluster is taken directly from a label/annotation on the broker object — fully attacker-controlled. The lighthouse-agent SA (which holds cluster-wide create/update on endpointslices and serviceimports per operator RBAC) then writes the object into that namespace on behalf of the remote cluster. There is no allowlist, no check that the namespace exists locally with matching ownership, and no check that the source cluster was authorized to export that {namespace, name}. A compromised spoke can inject EndpointSlices and ServiceImports into any namespace on peer clusters, including kube-system and openshift-* namespaces.

Source: Project Glasswing AI-SAST audit of submariner-io/lighthouse.
Finding ID: FIND-002
Assurance: execution_proven