CVE-2026-59269 Privilege escalation in Pinniped
Attackers with AD group edit access can escalate Kubernetes privileges via LDAP injection in Pinniped Supervisor when specific configurations are present.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59269?
CVE-2026-59269 is a low-severity vulnerability in VMware Pinniped, published on 9 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.
Which versions are affected by CVE-2026-59269?
How do I fix CVE-2026-59269?
No fix has been published for CVE-2026-59269 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-59269 being exploited?
There is no known exploitation of CVE-2026-59269 in the wild and no public exploit code.
Sources
Also known as GHSA-7xq8-m6h6-2xg8.