Submariner Cert-Auth CableName Injection Remote Code Execution

Technical Analysis

The vulnerability stems from improper input validation of the CableName field, which is derived from free-form CRD strings and used directly to build ipsec.conf connection configurations. By embedding newline characters and IPsec directives (including leftupdown hook paths), an attacker controlling a federated/connected cluster can inject arbitrary configuration parameters that Libreswan/strongSwan will parse and execute. The leftupdown hook mechanism allows execution of attacker-specified scripts or commands with root privileges on the Submariner gateway node, resulting in full RCE and potential lateral movement across the multi-cluster mesh. This is a classic configuration/command injection pattern exploiting trust boundaries between clusters in a federated Kubernetes environment. Organizations running AI agent orchestration or RAG pipelines across federated Kubernetes clusters using Submariner for cross-cluster service connectivity are at risk of gateway node compromise, which could expose agent service credentials, API keys, and inter-cluster traffic to attacker-controlled root processes.

Affected Systems

Submariner deployments using cert-auth mode for gateway connection authentication; Kubernetes clusters interconnected via Submariner CRDs (Cluster, Endpoint resources) where CableName values are not sanitized; gateway nodes running Libreswan/strongSwan IPsec implementations invoked via leftupdown hooks

Indicators of Compromise

• N/A - configuration-based logic flaw, no known file hashes, IPs, or domains associated; monitor for anomalous CableName values containing newline characters or ipsec.conf directive strings (e.g. 'leftupdown=', 'also=') in Submariner CRD objects

Remediation Steps

1. 1

   Upgrade Submariner

   Apply the patched Submariner release that validates and sanitizes CableName and other CRD-derived fields before use in ipsec.conf generation.

2. 2

   Restrict cluster trust

   Limit which clusters can join a Submariner broker/federation and enforce strict admission control on Cluster/Endpoint CRD submissions.

3. 3

   Input validation gating

   Deploy an admission webhook to reject CableName or related fields containing newlines, semicolons, or IPsec directive keywords.

4. 4

   Least privilege gateway nodes

   Run Submariner gateway components with reduced privileges or in isolated namespaces/nodes to limit blast radius of root RCE.

5. 5

   Audit and monitor

   Review gateway node IPsec configuration files and process execution logs for unauthorized leftupdown hook invocations.