Skip to content
OpenAdvisories
High · 7.1 CVE-2026-32769 EUVD-2026-13420GHSA-hxm7-9q36-c77fGO-2026-4715

Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Published Mar 20, 2026 · Updated Mar 20, 2026 · Assigned by GitHub_M

Description

Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace. The flawed inter-ns NetworkPolicy breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This issue has been fixed in version 0.1.1. To workaround, delete the failing network policy that should be prefixed by inter-ns- in the target namespace.

Affected products

VendorProductAffectedFixed
ctfer-io fullchain < 0.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260326T203309-150000.1.155.2 SUSE-SU-2026:1135-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/ctfer-io/fullchain < 0.1.1 0.1.1 GHSA-hxm7-9q36-c77f

Advisories 2

References