CVE-2026-32720

Katalog CVE

CVSS 7.1 · High EPSS 0,42%

Kerentanan Improper Access Control. Skor CVSS 4.0 7.1 (High) menurut github.com.

Deskripsi (NVD)

The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This vulnerability is fixed in 0.2.1.

Rincian

Terbit di NVD

16 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

7.1 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ctfer-io/monitoring/security/advisories/GHSA-7x23-j8gv-v54x