CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
An attacker can delete another tenant's container resources by forging deployment annotations in multi-tenant Radius installations, causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53999?
CVE-2026-53999 is a high-severity vulnerability in radius-project radius, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.
Which versions are affected by CVE-2026-53999?
3 open source packages ship an affected version, including github.com/radius-project/radius.
| Package | Affected | Fixed in |
|---|---|---|
github.com/radius-project/radius Go | All versions | 0.58.0 |
github.com/radius-project/radius Go | All versions | 0.58.0 |
github.com/radius-project/radius Go | All versions | 0.58.0 |
How do I fix CVE-2026-53999?
Upgrade github.com/radius-project/radius to 0.58.0 or later.
Is CVE-2026-53999 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53999 exists.
Sources
Also known as GHSA-fp5j-4fj2-4jvq, GO-2026-5373.