Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M
CVE-2026-32768Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
High 7.9
In plain English
A high-severity improper access control in chall-manager from ctfer-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ctfer-io/chall-manager/deploy | 0.6.5 | GHSA-mw24-f3xh-j3qv |
| Go | github.com/ctfer-io/chall-manager/deploy | 0.6.5 | GO-2026-4718 |
| Go | github.com/ctfer-io/chall-manager/sdk | 0.6.5 | GHSA-mw24-f3xh-j3qv |
| Go | github.com/ctfer-io/chall-manager/sdk | 0.6.5 | GO-2026-4718 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ctfer-io | chall-manager | < 0.6.5 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H