CVE-2026-32769 Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace
A misconfigured NetworkPolicy in Fullchain allows attackers to pivot laterally across namespaces, bypassing intended isolation boundaries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32769?
CVE-2026-32769 is a high-severity vulnerability in ctfer-io fullchain, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace. The flawed inter-ns NetworkPolicy breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This issue has been fixed in version 0.1.1. To workaround, delete the failing network policy that should be prefixed by inter-ns- in the target namespace.
Weakness: CWE-284
Which versions are affected by CVE-2026-32769?
3 open source packages ship an affected version, including github.com/ctfer-io/fullchain. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ctfer-io/fullchain Go | All versions | 0.1.1 |
github.com/ctfer-io/fullchain Go | All versions | 0.1.1 |
github.com/ctfer-io/fullchain Go | All versions | 0.1.1 |
Products include Ctfer Fullchain.
How do I fix CVE-2026-32769?
Upgrade github.com/ctfer-io/fullchain to 0.1.1 or later.
Is CVE-2026-32769 being exploited?
There is no known exploitation of CVE-2026-32769 in the wild and no public exploit code.
Sources
Also known as GHSA-hxm7-9q36-c77f, GO-2026-4715.