Description

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-20T19:16:58.637Z",
  "pubdate": "2026-08-20T19:16:58.637Z",
  "executiveSummary": "A vulnerability has been identified within the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes, specifically involving insufficient validation of advertised IP addresses within EndpointSlice objects.\nThis security flaw enables a compromised spoke cluster to manipulate cross-cluster service resolution by publishing attacker-controlled IP addresses, thereby hijacking legitimate traffic destined for services across different clusters.\nThe primary impact of this vulnerability is the facilitation of transparent Man-in-the-Middle (MITM) attacks on inter-cluster service communications, which can subsequently lead to unauthorized information disclosure and data manipulation.\nThe affected product is Red Hat Advanced Cluster Management for Kubernetes, specifically its lighthouse component.\nThe risk implications are severe for multi-cluster Kubernetes deployments utilizing this technology, as compromise of a single spoke cluster grants the attacker the capability to intercept and compromise traffic from other trusted clusters within the mesh.\nExploitation requires the attacker to have prior compromise of a spoke cluster, allowing them to create malicious EndpointSlices that the lighthouse DNS resolution mechanism processes without adequate sanitization or verification.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of sufficient input validation and verification mechanisms applied to advertised IP addresses contained within EndpointSlice objects processed by the lighthouse component.\nThe vulnerable component is the lighthouse module responsible for cross-cluster service discovery and DNS management in Red Hat Advanced Cluster Management for Kubernetes.\nNetwork exposure involves multi-cluster communication channels where lighthouse aggregates endpoint information across disparate Kubernetes clusters.\nThe exploitation method leverages the trust model of multi-cluster service discovery. An attacker who has achieved administrative or write access to a compromised spoke cluster can craft and publish malicious EndpointSlice objects containing arbitrary, attacker-controlled IP addresses.\nThe attack flow proceeds as follows: First, the attacker compromises a spoke cluster and gains the necessary privileges to create or modify Kubernetes resources such as EndpointSlices. Second, the attacker populates these EndpointSlices with malicious IP addresses designed to impersonate legitimate cross-cluster services. Third, the lighthouse component consumes these unvalidated EndpointSlice objects and propagates the fraudulent address mappings into the global lighthouse DNS system. Fourth, when a legitimate workload in another cluster attempts to resolve and communicate with the targeted cross-cluster service, the lighthouse DNS directs the traffic to the attacker-controlled endpoints.\nThis payload behavior results in a transparent Man-in-the-Middle (MITM) condition, where the adversary can intercept, inspect, modify, or drop transit data between cluster services.\nPost-exploitation impact includes unauthorized information disclosure, such as the capture of sensitive payloads transmitted across cluster boundaries, as well as potential data manipulation affecting the integrity of distributed applications."
}