submariner npm Package Vulnerability: Critical CVE-2026-66786 Alert
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- submariner (npm)
- Patched version
- Not yet available
A critical flaw has been reportedly found in the submariner npm package. This vulnerability could allow remote code execution as root on the gateway node.
What happened
An early warning has been issued for a critical flaw in the submariner npm package. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
The vulnerability, tracked as CVE-2026-66786, has a CVSS score of 9.1 and is classified as critical. It is under investigation and has not been exploited in the wild as of the latest reports. The flaw is specific to the submariner package and affects an unknown version range. No authoritative version range has been published yet.
What to do about it
- Monitor the primary sources for updates on a fixed version of submariner.
- No official fix has been published yet. Stay informed by consulting the primary sources below.
- Rotate any secrets in environments that use submariner as a precaution.
- Consider implementing additional security measures to protect against potential exploitation until a fix is available.
How 0Day would have caught this
submariner is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the submariner npm package in your projects, you may be affected. The exact version range is not yet known, so it is advisable to monitor updates closely.
What should I do right now?
Monitor the primary sources for updates on a fixed version of submariner. Rotate any secrets in affected environments as a precautionary measure.
Is there a patched version available?
No official fix has been published yet. Continue to monitor the primary sources for updates.
How severe is this vulnerability?
The vulnerability is classified as critical with a CVSS score of 9.1. It has the potential for remote code execution as root on the gateway node.