Description

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T17:17:00.580Z",
  "pubdate": "2026-08-18T17:17:00.580Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in the Submariner operator due to the insecure handling of cryptographic material within the Submariner Custom Resource (CR). Specifically, the IPsec pre-shared key (PSK), which is fundamentally required to secure and authenticate network communication across interconnected Kubernetes clusters in the mesh, is stored in plaintext rather than encrypted or referenced securely via native Kubernetes secrets mechanisms.\nThe primary impact of this flaw is the potential compromise of inter-cluster confidentiality. Unauthorized actors or malicious entities who gain read access to the Submariner Custom Resource can extract the raw IPsec PSK. With this cryptographic material in hand, an attacker possesses the capability to passively capture and decrypt encrypted network traffic flowing between any two participant clusters within the Submariner mesh.\nThe vulnerability affects the Submariner operator and its management of the Submariner Custom Resource configuration. Exploitation requires unauthorized parties to have read access to the cluster configuration resources where the Custom Resource resides. While no complex exploitation routines or active payload injections are necessary due to the passive nature of the cryptographic compromise, the downstream risk implications are severe, directly leading to unauthorized data exposure across multi-cluster boundaries.",
  "technicalDetails": "The root cause of the vulnerability stems from design or implementation practices within the Submariner operator where sensitive authentication parameters are handled as raw data strings directly inside the Submariner Custom Resource configuration rather than delegated to secure secret stores or encrypted at rest using envelope encryption mechanisms native to Kubernetes.\nThe vulnerable component is the Submariner operator's Custom Resource definition and handling logic responsible for parsing and deploying cluster-to-cluster networking configurations. The IPsec pre-shared key acts as the symmetric cryptographic foundation for establishing secure Internet Protocol Security associations between gateways in different Kubernetes clusters.\nAuthentication and privilege requirements depend on the access control policies (RBAC) configured within the target Kubernetes cluster. An attacker or compromised service account must possess permissions to read Custom Resources associated with Submariner within the relevant namespaces. Network exposure encompasses the entire multi-cluster mesh architecture, as the compromise of a single localized secret compromises the cryptographic integrity of all participating cross-cluster tunnels.\nThe step-by-step attack flow proceeds as follows: First, an unauthorized user or compromised entity with read-level access queries the Kubernetes API server for the Submariner Custom Resource instance. Second, the API server returns the manifest containing the configuration parameters. Third, the attacker parses the returned data structure to locate the IPsec pre-shared key stored in unencrypted plaintext. Fourth, utilizing network sniffing or tapping capabilities at any vantage point capable of observing the inter-cluster transport medium, the attacker captures the encrypted IPsec encapsulation traffic. Finally, utilizing the extracted plaintext pre-shared key, the attacker performs passive decryption of the captured IPsec packet payloads, recovering sensitive cross-cluster application data and administrative traffic without triggering defensive intrusion detection alerts."
}