CVE-2026-66788 received a 9.9 CVSS because a compromised spoke cluster can inject Kubernetes objects into kube-system and openshift-* namespaces on peer clusters via Lighthouse's broker metadata derivation. The severity is accurate. But the score obscures a more important truth: this isn't an anomalous flaw — it's what happens when a multi-cluster networking tool operates under an implicit trust model that was never explicitly defined or defended.
Lighthouse (and Submariner more broadly) was designed with an unstated assumption: authenticated spokes are trusted spokes. When broker metadata drives namespace targeting without validation, a compromised spoke doesn't exploit an edge case — it operates exactly as the architecture permits for authenticated participants. The escalation path from namespace injection to cluster-level compromise was latent in the design from the start.
The practical problem is twofold. First, there's no detection surface. The injected EndpointSlices and ServiceImports look identical to legitimate cross-cluster service discovery — defenders cannot see they've been compromised through this vector because the attack produces the same observable artifacts as normal operation. Second, the EPSS score (low) likely reflects not rarity of exploitation but topology blindness: most organizations cannot enumerate their active spoke-to-broker trust relationships, so they cannot assess their exposure, and attackers similarly cannot scan for this attack surface.
The fix is not merely patching this CVE. The fix requires engineering workflow changes that force threat modeling into implementation — code review prompts or linters flagging "trust derivation from authenticated-but-not-hardened sources" would catch this vulnerability class before it lands in production. More broadly, the multi-cluster networking ecosystem conflates authentication with authorization consistently, and this CVE is the latest instance of a pattern with documented lineage in Kerberos cross-realm trust, SAML federation misconfigurations, and service mesh mTLS where authenticated endpoints were treated as authorized destinations. The community keeps rediscovering this failure mode without capturing the architectural pattern into institutional memory.
Defenders should prioritize two actions: verify whether their Submariner/Lighthouse deployments derive namespace targeting from broker metadata and implement observability that can distinguish legitimate cross-cluster traffic from namespace injection from compromised spokes. The architectural question — what happens when a spoke is malicious — remains unanswered by every major multi-cluster vendor, and this CVE demonstrates why that silence is untenable.