EUVD-2026-62851
GHSA-q4gw-3xwf-fpcw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Low-privilege authenticated cluster access required to create pods; bypassing image policy yields high confidentiality and integrity impact with no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.
AnalysisAI
Image policy bypass in IBM Portieris 0.5.0 through 0.14.2 allows remote authenticated attackers to circumvent container image verification controls by exploiting improper authorization of pod owner references (CWE-862). An attacker with low-privilege Kubernetes cluster access can deploy containers from untrusted or unverified images, effectively nullifying the admission controller's entire security enforcement purpose. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Kubernetes account with at least pod creation (or equivalent workload resource) permissions within the cluster where IBM Portieris 0.5.0-0.14.2 is deployed as an admission controller. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score reflects a network-exploitable flaw (AV:N/AC:L) requiring only low-privilege authentication (PR:L), with High Confidentiality and High Integrity impacts - consistent with the ability to run arbitrary, potentially malicious container images inside a cluster. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch provided by IBM per the advisory at https://www.ibm.com/support/pages/node/7284125. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kubernetes clusters running IBM Portieris versions 0.5.0-0.14.2 and document which users possess the cluster access required to exploit this authenticated vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today