CVE-2026-66788 — Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived…
Published: 2026-08-20 · CVSS: 9.9 · CVSS 3.1
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7