CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCVE-2026-23634
Medium (4.3) in defenseunicorns pepr. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in pepr 1.0.5.
Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWE
- CWE-272
- Published
- Modified
- Record from
- the NVD, synced
Affected
- defenseunicorns:pepr
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w54x-r83c-x79q | npm | pepr | <1.0.5 | 1.0.5 |