External risk intelligence

Submariner Endpoint Spoofing Allows Network Traffic Redirection

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-66785

Submariner facilitates cross-cluster communication within private Kubernetes environments. It is deployed as internal infrastructure, not a public-facing service. Exposure is restricted to controlled private connectivity between known clusters, making direct public internet exposure uncommon, despite the network-based attack vector.

Information Disclosure

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Submariner that could allow a compromised cluster to redirect network traffic from other connected clusters. This occurs because the system does not correctly validate network subnets, permitting an attacker to reroute traffic through their connection, potentially exposing sensitive information or disrupting network operations.

Malicious cluster can redirect traffic from others.
Compromise could lead to data exposure or disruption.
Confirm if your network traffic is exposed.

Attack Path

How an attacker could exploit the issue

An attacker controlling a compromised Submariner cluster can manipulate network traffic between connected clusters. By publishing a specially crafted network endpoint with invalid subnet information, the attacker can trick other clusters into sending their traffic through the compromised cluster's tunnel. This could expose sensitive data or disrupt network operations.

Requires authenticated access to a Submariner cluster.
Publishing a specially crafted network endpoint triggers the flaw.
Risk of data disclosure or network disruption.

Live Threat

Current exploitation, exposure, and threat context

A flaw in Submariner could allow a compromised cluster to reroute network traffic from other connected clusters. This happens when the system does not adequately validate network subnets provided by a malicious cluster, enabling it to specify arbitrary network ranges. Consequently, traffic intended for these ranges could be sent through the attacker's connection, potentially leading to data exposure or service interruption.

Network traffic and internal cluster communication.
Malicious cluster publishes crafted network endpoint.
Information disclosure or network disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders and platform teams are likely responsible for addressing this vulnerability in Submariner, as it impacts the network traffic routing between connected clusters. The immediate first step is to identify all deployments of Submariner, determine their network exposure and criticality, and then confirm the accountable owner before planning remediation, potentially involving vendor coordination or temporary risk reduction measures.

Identify Submariner deployments and owners.
Verify network reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Submariner?

Submariner is a tool designed to provide direct network connectivity between different Kubernetes clusters. It functions as the underlying infrastructure that enables pods in one cluster to communicate with pods in another, effectively linking separate environments into a unified private network mesh.

How does CVE-2026-66785 impact network security?

This vulnerability is classified as Improper Input Validation (CWE-20). It means the software fails to verify that the network ranges claimed by a connected cluster are legitimate. An attacker can exploit this to falsely claim ownership of network traffic, causing other clusters to send data to the attacker instead of the intended destination.

Do I need to be directly connected to trigger this flaw?

Yes, an attacker must have control over a cluster already joined to the Submariner network. Merely being on the internet is insufficient; the attacker must be a recognized participant within the private multi-cluster infrastructure to publish the malicious network endpoint that initiates the redirection.

Is my environment at risk if it is not exposed to the internet?

Halo Surface Signal indicates that while the attack is network-based, Submariner is typically deployed as internal infrastructure rather than a public service. Even if your clusters are not directly reachable from the public internet, the vulnerability remains a concern if a single cluster within your private mesh is compromised.

When should I begin my response to this advisory?

Start by identifying all current Submariner deployments across your organization. Once you have a list, determine which clusters are critical to your operations and verify their ownership. This inventory allows you to assess the potential impact of traffic redirection and coordinate with your team to plan the necessary remediation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.