Description

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-02T18:21:10.517Z",
  "pubdate": "2026-09-02T18:21:10.517Z",
  "executiveSummary": "A critical command injection vulnerability exists within the Submariner project when configured in cert-auth mode. The flaw stems from insufficient input validation of free-form strings sourced from Custom Resource Definitions (CRDs).\nAn authenticated attacker controlling a rogue or compromised cluster can manipulate the CableName field to inject malicious ipsec.conf directives. By leveraging newline injection, an attacker can append arbitrary configuration parameters, including the abuse of leftupdown hooks.\nThis vulnerability leads to Remote Code Execution (RCE) with root privileges on the gateway node. The risk is significant as it allows for full compromise of the underlying host operating system, potentially facilitating lateral movement across the cluster infrastructure.\nExploitation requires the attacker to have the ability to influence the configuration of the Submariner CRDs, effectively making this an issue where a malicious cluster member can attack the gateway node of the host or peer cluster.",
  "technicalDetails": "The root cause of this vulnerability is improper sanitization of user-controlled input within the connection configuration build process. In cert-auth mode, Submariner dynamically constructs IPsec configurations by concatenating strings derived from the CableName field defined in the CRD.\nThe application fails to neutralize newline characters and control sequences within this input. Because the underlying configuration mechanism relies on generating flat-file configurations for the IPsec daemon (such as StrongSwan), these injected characters allow an attacker to escape the intended configuration context.\nThe attack flow begins when an attacker modifies the CableName field to contain newline-delimited directives. For instance, by injecting characters such as '\\n', the attacker forces the configuration generator to interpret subsequent strings as new configuration directives rather than literal parameter values.\nSpecifically, the attacker can inject 'leftupdown' parameters into the generated ipsec.conf file. The 'leftupdown' directive in IPsec configurations is designed to execute scripts during interface state transitions. By pointing this directive to an attacker-controlled script or an existing binary on the system, the attacker achieves arbitrary command execution.\nBecause the IPsec daemon typically runs with elevated privileges on the gateway node, the triggered script or command executes with root-level access. This bypasses security boundaries and provides the attacker with full control over the gateway node.\nThe vulnerability is restricted to the cert-auth mode, which is a specific configuration subset of Submariner. It requires an attacker to be capable of submitting or modifying CRDs that the Submariner controller processes. Given the nature of Kubernetes CRD-based management, this implies that any entity with RBAC permissions to create or update the relevant Submariner custom resources can trigger this configuration injection.\nPost-exploitation, an attacker can deploy persistent backdoors, extract sensitive cryptographic material from the gateway, or use the node as a pivot point to compromise the internal network of the affected cluster. The lack of input validation at the configuration generation layer renders the system unable to distinguish between legitimate configuration data and malicious command payloads."
}