Skip to content
OpenAdvisories
High · 7.9 CVE-2026-32737 EUVD-2026-12999GHSA-fgm3-q9r5-43v9GO-2026-4714

Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Published Mar 18, 2026 · Updated Mar 20, 2026 · Assigned by GitHub_M

Description

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod out of it. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. Removing the `inter-ns` NetworkPolicy patches the vulnerability in version 0.2.1. If updates are not possible in production environments, manually delete `inter-ns` and update as soon as possible. Given one's context, delete the failing network policy that should be prefixed by `inter-ns-` in the target namespace.

Affected products

VendorProductAffectedFixed
ctfer-io romeo < 0.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260326T203309-150000.1.155.2 SUSE-SU-2026:1135-1

Affected packages

Advisories 2

References