Description

A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-20T19:16:58.463Z",
  "pubdate": "2026-08-20T19:16:58.463Z",
  "executiveSummary": "A critical network redirection vulnerability has been identified in Submariner. This security flaw allows a compromised or malicious spoke cluster within a multi-cluster topology to manipulate routing configurations by publishing specially crafted network endpoints. The vulnerability stems from a failure of the system to properly validate and restrict the network subnets provided by connected clusters, allowing a malicious entity to declare arbitrary network ranges.\nThe primary impact of this vulnerability is unauthorized information disclosure and severe network disruption across peer clusters. By declaring arbitrary subnets, the attacker forces peer clusters to reroute all network traffic intended for those specific IP ranges directly through the attacker-controlled tunnel. This exposes sensitive cross-cluster communications to interception, tampering, or dropping.\nThe affected product is Submariner. To successfully exploit this vulnerability, an attacker requires control over a participating spoke cluster within the Submariner mesh. The attack leverages inherent trust relationships within the multi-cluster networking architecture, bypassing standard boundary controls because the control plane accepts unvalidated network endpoint advertisements from connected member clusters.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of strict input validation and authorization checks within Submariner's network endpoint registration and advertisement mechanism. Specifically, when a spoke cluster registers its network endpoints with the central broker or peer clusters, the system fails to verify whether the advertised subnets legitimately belong to the registering cluster or fall within its authorized allocation boundaries.\nThe vulnerable component is the Submariner network endpoint validation and routing synchronization logic. In a standard operational state, Submariner establishes secure tunnels between connected clusters and automatically updates routing tables based on published endpoint information to facilitate seamless multi-cluster communication. However, the absence of cryptographic or policy-based validation on these advertisements permits a malicious participant to inject arbitrary CIDR blocks into the routing update stream.\nThe attack flow proceeds as follows: First, an attacker compromises or provisions a malicious spoke cluster integrated into the Submariner deployment. Second, the malicious cluster crafts and publishes a network endpoint advertisement containing broad or specific target subnets belonging to peer clusters or external routed networks. Third, the Submariner control plane propagates these malicious routing entries to all connected peer clusters without validation. Fourth, the peer clusters update their local routing tables, redirecting all outbound traffic destined for the targeted IP ranges into the IPsec or VXLAN tunnel terminating at the attacker's cluster.\nPost-exploitation impact includes the interception of sensitive data traversing the cross-cluster network, man-in-the-middle (MitM) capabilities against peer services, and denial of service (DoS) conditions caused by dropping or blackholing redirected traffic. Network exposure is inherent to the multi-cluster architecture where spoke clusters communicate with the broker and peers. Exploitation requires administrative or programmatic control over a legitimate spoke cluster participating in the Submariner mesh, allowing the attacker to publish arbitrary metadata to the shared control plane."
}