CVE-2026-32720
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control
Impact
### Impact Due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. ### Patch Removing the `inter-ns` NetworkPolicy patches the vulnerability. If updates are not possible in production environments, we recommend to manually delete it and update as soon as possible. ### Workaround Given your context, delete the failing network policy that should be prefixed by `inter-ns-` in the monitoring namespace. You can use the following to delete all matching network policy. If unsure of the outcome, please do it manually. ```bash for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^monitoring-'); do kubectl -n "$ns" get networkpolicy -o name \ | grep '^networkpolicy.networking.k8s.io/inter-ns-' \ | xargs -r kubectl -n "$ns" delete done ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ctfer-io/monitoring | < 0.2.1 | 0.2.1 |
Affected products
| Product | Affected versions |
|---|---|
| Various Signals (I.E. Logs, Metrics And Distributed Traces). | before 0.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ctfer-io/monitoring/security/advisories/GHSA-7x23-j8gv-v54x
- https://github.com/advisories/GHSA-7x23-j8gv-v54x
- https://github.com/ctfer-io/monitoring/pull/168
- https://github.com/ctfer-io/monitoring/commit/5404a11863b32b14ee5c62d1215352ab519d4edb
- https://github.com/ctfer-io/monitoring/releases/tag/v0.2.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-32720