Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod out of it. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. Removing the `inter-ns` NetworkPolicy patches the vulnerability in version 0.2.1. If updates are not possible in production environments, manually delete `inter-ns` and update as soon as possible. Given one's context, delete the failing network policy that should be prefixed by `inter-ns-` in the target namespace.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ctfer-io | romeo | before 0.2.1 | 0.2.1 | Patch available | CNA |
| — | github.com/ctfer-io/romeo/environment/deploy (Go) | before 0.2.1 | 0.2.1 | Patch available | GHSA-fgm3-q9r5-43v9 |
- romeo Vendorctfer-io Affected before 0.2.1 Fixed in 0.2.1 Patch available CNA
- github.com/ctfer-io/romeo/environment/deploy (Go) Vendor— Affected before 0.2.1 Fixed in 0.2.1 Patch available GHSA-fgm3-q9r5-43v9
Remediation
- Fix · CNA romeo (ctfer-io) Fixed in 0.2.1
- Fix · GHSA-fgm3-q9r5-43v9 github.com/ctfer-io/romeo/environment/deploy (Go) Fixed in 0.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32737
- 2026-10-03 Alias added: GHSA-fgm3-q9r5-43v9
References
More ctfer-io Romeo vulnerabilities
- TI-2026-25275 Romeo is vulnerable to Archive Slip due to missing checks in sanitization CVSS 4.0HIGH 8.3
Sources
- CVE-2026-32737 · CVE Program
- CVE-2026-32737 · NVD
- FIRST EPSS
- GHSA-fgm3-q9r5-43v9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences