CVE-2026-32768 Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

What is CVE-2026-32768?

CVE-2026-32768 is a high-severity vulnerability in ctfer-io chall-manager, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.

Weakness: CWE-284

Which versions are affected by CVE-2026-32768?

6 open source packages ship an affected version, including github.com/ctfer-io/chall-manager/deploy and github.com/ctfer-io/chall-manager/sdk. It affects 1 product.

Products include Ctfer-Io Chall-Manager.

How do I fix CVE-2026-32768?

Upgrade github.com/ctfer-io/chall-manager/deploy to 0.6.5 or later.

Is CVE-2026-32768 being exploited?

There is no known exploitation of CVE-2026-32768 in the wild and no public exploit code.

Other vulnerabilities in ctfer-io chall-manager

• CVE-2025-53632 Chall-Manager's scenario decoding process does not check for zip slips High 8.8
• CVE-2025-53633 Chall-Manager's scenario decoding process does not check for zip bombs High 8.7
• CVE-2025-53634 Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mw24-f3xh-j3qv, GO-2026-4718.