CVE-2026-32768highCWE-284

CVE-2026-32768: falha de alta gravidade em ctfer-io chall-manager

Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Publicada em

Seguir esta CVE+ Monitorar chall-manager+ Monitorar github.com/ctfer-io/chall-manager/deploy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.9epss 0.3%
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Produtos afetados
ctfer-io · chall-manager
CVEs relacionadas — ctfer-io chall-manager

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53632HIGHChall-Manager's scenario decoding process does not check for zip slipsEPSS 0.8%CVE-2025-53633HIGHChall-Manager's scenario decoding process does not check for zip bombsEPSS 0.5%CVE-2025-53634HIGHChall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacksEPSS 0.5%