CVE-2026-53999
- Source
- https://cve.org/CVERecord?id=CVE-2026-53999
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53999.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53999
- Aliases
- Downstream
- Related
- Published
- 2026-10-14T18:39:25Z
- Modified
- 2026-10-16T02:47:51Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
- Summary
- Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
- Details
-
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-20", "CWE-441" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53999.json" }- References
-
- https://github.com/radius-project/radius/releases/tag/v0.58.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53999.json
- https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvq
- https://nvd.nist.gov/vuln/detail/CVE-2026-53999
- https://github.com/radius-project/radius/commit/c4174fc205b838d5eab4f64b4909001ab08c0587
- https://github.com/radius-project/radius/pull/11967