CVSS 4.0
7.1 highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:HCVE-2026-32720
High (7.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/ctfer-io/monitoring 0.2.1.
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This vulnerability is fixed in 0.2.1.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-11-01)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7x23-j8gv-v54x | Go | github.com/ctfer-io/monitoring | <0.2.1 | 0.2.1 |
| GO-2026-4701 | Go | github.com/ctfer-io/monitoring | <0.2.1 | 0.2.1 |