CVE-2026-32768

Katalog CVE

CVSS 9.9 · Critical EPSS 0,52%

Kerentanan Improper Access Control pada ctfer-io chall-manager. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-mw24-f3xh-j3qv mitigasi · advisory vendor
• https://github.com/ctfer-io/chall-manager/commit/dc5ef27dfed2befef7f506ab8ca14d062b0d79c5 patch
• https://github.com/ctfer-io/chall-manager/releases/tag/v0.6.5 release notes