Kubernetes
CVE-2026-32720
HIGH
GHSA-7x23-j8gv-v54x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Impact
Due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement.
Patch
Removing the inter-ns NetworkPolicy patches the vulnerability. If updates are not possible in production environments, we recommend to manually delete it and update as soon as possible.
Workaround
Given your context, delete the failing network policy that should be prefixed by inter-ns- in the monitoring namespace. You can use the following to delete all matching network policy. If unsure of the outcome, please do it manually.
for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^monitoring-'); do
kubectl -n "$ns" get networkpolicy -o name \
| grep '^networkpolicy.networking.k8s.io/inter-ns-' \
| xargs -r kubectl -n "$ns" delete
doneAnalysisAI
A misconfigured NetworkPolicy in Kubernetes deployments allows attackers to perform unauthorized lateral movement between namespaces, breaking namespace isolation security boundaries. This vulnerability affects Kubernetes environments with improperly configured inter-namespace NetworkPolicies, specifically those with 'inter-ns' prefixed policies in monitoring namespaces. An attacker who compromises any component can pivot to access resources in other namespaces, potentially accessing sensitive data or systems they shouldn't have access to.
Technical ContextAI
This vulnerability stems from a NetworkPolicy misconfiguration in Kubernetes environments, which are container orchestration platforms that use namespaces to provide logical isolation between different applications and teams. The root cause is improper access control (CWE-284), where the 'inter-ns' NetworkPolicy incorrectly allows traffic between namespaces that should be isolated. NetworkPolicies in Kubernetes act as firewall rules at the namespace level, controlling ingress and egress traffic between pods. When misconfigured, they can inadvertently create security holes that violate the principle of least privilege and namespace isolation.
RemediationAI
Remove all NetworkPolicies prefixed with 'inter-ns' from monitoring namespaces immediately. The provided bash script can automate this process by iterating through monitoring namespaces and deleting matching policies, though manual verification is recommended in production environments. For a permanent fix, update the deployment configuration to exclude these misconfigured policies. Organizations unable to immediately update should use the workaround command: kubectl commands to identify and delete policies matching 'networkpolicy.networking.k8s.io/inter-ns-' pattern in monitoring namespaces. Ensure proper NetworkPolicy configurations are in place to maintain namespace isolation after removal.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today