CVE-2026-53999
Deferred Deferred - Pending Action

Privileged Container Deletion in Radius Kubernetes Controller

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-53999
EUVD
EUVD-2026-101606

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
radius-project radius < 0.58.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53999 is a high-severity vulnerability in the Radius Kubernetes controller affecting versions 0.57.1 and earlier. The issue involves a configuration-validation flaw where the controller deserializes user-controllable JSON data from the radapp.io/status annotation on Deployments without validating whether the referenced resource IDs belong to the current tenant. This allows an attacker in a multi-tenant environment to inject a malicious annotation that tricks the controller into deleting a container resource belonging to another tenant, following a Confused Deputy attack pattern.

Detection Guidance

To detect this vulnerability, monitor Kubernetes Deployment annotations for unauthorized modifications to the radapp.io/status field. Check for suspicious deletions of Radius-managed container resources by reviewing controller logs in pkg/controller/reconciler/deployment_reconciler.go. Use kubectl get deployments --all-namespaces -o jsonpath='{.items[*].metadata.annotations.radapp\.io/status}' to inspect annotations across all Deployments.

Impact Analysis

In a multi-tenant installation, this vulnerability can delete another team's recoverable container resource and disrupt service. In a single-tenant installation, the impact is limited to self denial of service. The attack requires permission to modify Deployment annotations and knowledge of the target resource's Radius ID. There is no data disclosure, privilege escalation, or persistence, and deleted resources can be recovered through standard Radius deployment workflows.

Compliance Impact

This vulnerability primarily affects multi-tenant environments where unauthorized resource deletion could disrupt services. While it does not directly disclose data or grant privileges, it may impact compliance by violating availability requirements in standards like GDPR (data processing integrity) or HIPAA (service continuity). The impact depends on deployment context and mitigation measures.

Mitigation Strategies

Upgrade to Radius version 0.58.0 or later to apply the fix. Restrict Kubernetes RBAC permissions to prevent unauthorized annotation modifications. Implement network isolation for multi-tenant environments. Enable Kubernetes admission policies to protect radapp.io/status annotations from tampering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart