CVE-2026-18544

Analyzed Analyzed - Analysis Complete

IBM Portieris Pod Owner Reference Authorization Bypass

Publication date: 2026-08-19

Last updated on: 2026-09-02

Assigner: IBM Corporation

Description

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-09-02

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-18544

EUVD

EUVD-2026-62851

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	portieris	From 0.5.0 (inc) to 0.14.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

IBM Portieris versions 0.5.0 through 0.14.2 have a flaw where a remote authenticated attacker can bypass image policy enforcement. This happens because the system improperly authorizes pod owner references, allowing unauthorized access to images.

Detection Guidance

Detection requires checking for IBM Portieris deployments between versions 0.5.0 and 0.14.2. Inspect running pods and container images for Portieris components. Verify pod owner references and authorization policies in Kubernetes clusters.

Impact Analysis

This vulnerability could allow attackers to bypass security policies and access unauthorized container images. If exploited, it may lead to data breaches, unauthorized code execution, or compromise of sensitive workloads in your environment.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems. GDPR and HIPAA mandate strict access controls; a bypass could result in non-compliance, potential fines, or legal consequences.

Mitigation Strategies

Update IBM Portieris to a version beyond 0.14.2 to address the authorization flaw. Review pod owner references and enforce stricter access controls for authenticated users.

Hi! I’m here to help you understand CVE-2026-18544. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70