A critical remote code execution vulnerability in Red Hat Advanced Cluster Management for Kubernetes allows an authenticated attacker to gain root privileges on the gateway node.

The flaw exists in the submariner component, where improper validation of free-form strings in the Custom Resource Definition allows for the injection of ipsec.conf directives. This permits an attacker with high privileges to execute arbitrary commands via leftupdown hooks, resulting in full system compromise.

The potential for remote code execution as root represents a critical security failure, warranting a CVSS score of 9.1. Successful exploitation could lead to total loss of confidentiality, integrity, and availability of the affected gateway node, potentially exposing the entire Kubernetes cluster to unauthorized control and catastrophic data breaches.

Immediate Action: Update Red Hat Advanced Cluster Management for Kubernetes 2.17 to the versions identified in the Red Hat security advisory RHSA-2026:63016 to ensure the fix is applied.

Proactive Monitoring: Monitor system logs for unexpected execution of shell commands, specifically tracking activity related to ipsec processes or calls to leftupdown hooks.

Compensating Controls: Restrict access to the creation and modification of Custom Resource Definitions to only the most trusted administrative accounts to reduce the attack surface.

Public Exploit Available: No

Given the critical severity of this vulnerability and the potential for full root compromise, administrators must prioritize patching this flaw immediately. Apply the provided vendor updates as soon as possible and audit existing cluster configurations for any signs of unauthorized modification to Custom Resource Definitions.