CVE-2026-32737
NetworkPolicy Misconfiguration in Romeo Allows Lateral Movement
Publication date: 2026-03-18
Last updated on: 2026-03-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ctfer-io | romeo | to 0.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Romeo, a tool that helps measure code coverage for Go applications within GitHub Actions. Prior to version 0.2.1, a mis-written NetworkPolicy allowed a malicious actor to pivot from the "hardened" namespace to any Pod outside of it. This breaks the expected security-by-default property of the deployment, enabling potential lateral movement within the environment.
The issue is fixed in version 0.2.1 by removing the problematic `inter-ns` NetworkPolicy. If updating is not possible, the workaround is to manually delete the `inter-ns` NetworkPolicy to mitigate the vulnerability.
How can this vulnerability impact me? :
This vulnerability can allow a malicious actor to move laterally from a secured namespace to other Pods outside that namespace. This lateral movement can lead to unauthorized access to resources and potentially compromise other parts of the system that were expected to be isolated and secure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the mis-written NetworkPolicy named with the prefix 'inter-ns-' in the target namespace. Identifying such a NetworkPolicy indicates the system is vulnerable to lateral movement.
A suggested command to detect this on a Kubernetes cluster is to list NetworkPolicies and filter those with the 'inter-ns-' prefix, for example:
- kubectl get networkpolicy -A | grep inter-ns-
If any NetworkPolicy with this prefix is found, it indicates the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to remove the vulnerable NetworkPolicy named with the prefix 'inter-ns-' in the target namespace.
If updating to version 0.2.1 or later is not possible in production environments, manually delete the 'inter-ns' NetworkPolicy to patch the vulnerability.
- kubectl delete networkpolicy inter-ns-<name> -n <target-namespace>
After deletion, update Romeo to version 0.2.1 or later as soon as possible to ensure the vulnerability is fully patched.