Description

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T17:17:00.710Z",
  "pubdate": "2026-08-18T17:17:00.710Z",
  "executiveSummary": "A critical security flaw has been identified in the Submariner operator that results in the unintended exposure of a long-lived broker service account bearer token.\nThe vulnerability manifests within the Submariner Custom Resource specification, where sensitive authentication material is improperly stored and exposed.\nThe primary impact of this flaw is the potential compromise of the entire multi-cluster mesh network, as possession of the broker service account token grants full administrative control over mesh resources.\nAffected systems include deployments utilizing the Submariner operator where Custom Resources store or display sensitive broker credentials.\nRisk implications are severe, as unauthorized entities gaining access to the cluster's etcd database or executing standard API queries via kubectl can retrieve the plaintext bearer token.\nAttacker capabilities include the ability to read the Submariner Custom Resource specification or directly query the underlying etcd data store.\nExploitation requirements include prior access to the Kubernetes API via kubectl with read permissions on the relevant Custom Resources, or direct, unauthorized access to the cluster's etcd backend.",
  "technicalDetails": "The root cause of the vulnerability lies within the handling and serialization logic of the Submariner operator, which improperly embeds a long-lived broker service account bearer token directly into the Submariner Custom Resource specification.\nThe vulnerable component is the Submariner operator and its associated Custom Resource definitions that manage broker authentication credentials.\nAuthentication requirements for exploitation depend on the vector: either read-level access to the Kubernetes API capable of executing kubectl get commands against Custom Resources, or direct infrastructure-level access to the etcd database.\nPrivilege requirements are moderate to low regarding API access, contingent upon RBAC configurations that permit reading Submariner Custom Resources.\nThe attack flow proceeds as follows: First, an attacker establishes unauthorized access to the Kubernetes cluster API utilizing legitimate read permissions or compromises the etcd datastore directly. Second, the attacker targets the Submariner Custom Resource specification. Third, by inspecting the CR manifest, the attacker extracts the exposed long-lived broker service account bearer token. Fourth, utilizing the acquired bearer token, the attacker authenticates directly to the broker API server with elevated privileges.\nPost-exploitation impact includes complete administrative control over the Submariner mesh network.\nAn attacker can leverage the compromised token to manage, modify, or delete critical network resources such as endpoints and secrets, thereby enabling malicious traffic manipulation, interception, or denial of service across connected cluster environments."
}