CVE-2026-59269

Katalog CVE

CVSS 3.8 · Low EPSS 0,27%

Skor CVSS 3.1 3.8 (Low) menurut vmware.com.

Deskripsi (NVD)

A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

3.8 (Low), sumber vmware.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8