CVE-2026-32768
CRITICALChall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Title source: cnaDescription
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.
Scores
CVSS v3
9.9
EPSS
0.0006
EPSS Percentile
17.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-284
Status
published
Products (2)
ctfer-io/chall-manager
< 0.6.5 (2 CPE variants)
ctfer-io/chall-manager
0 - 0.6.5 (2 CPE variants)Go
Published
Mar 20, 2026
Tracked Since
Mar 20, 2026