CVE-2026-32768

CRITICAL

Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Title source: cna
STIX 2.1

Description

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.

References (3)

Core 3

Scores

CVSS v3 9.9
EPSS 0.0028
EPSS Percentile 19.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (2)
ctfer-io/chall-manager < 0.6.5 (2 CPE variants)
ctfer-io/chall-manager 0 - 0.6.5 (2 CPE variants)Go
Published Mar 20, 2026
Tracked Since Mar 20, 2026