N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23634

CVE-2026-23634: Pepr Overly Permissive RBAC ClusterRole in Admin Mode

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23634

CVE-2026-23634:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pepr	npm	< 1.0.5	1.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch for CVE-2026-23634 in Pepr reveals that the vulnerability is not a traditional code flaw but rather an insecure default configuration. The patch modifies the init command in src/cli/init/index.ts to add a warning about the default admin RBAC mode, which grants cluster-admin privileges. This indicates that the init function is responsible for creating new Pepr modules with this overly permissive and insecure default setting. Therefore, the init function is identified as the key function related to this vulnerability. Although it is not directly exploited, it is the source of the security weakness. The patch doesn't change the default behavior but aims to mitigate the risk by informing the user. No other functions in the patch were directly related to the creation of the vulnerable configuration.

Vulnerable functions

init

src/cli/init/index.ts

The vulnerability lies in the default configuration of new Pepr modules, which grants cluster-admin privileges. The `init` function, located in `src/cli/init/index.ts`, is responsible for creating these modules. The patch adds a warning to this function, highlighting that it sets up an insecure default configuration. While not directly exploitable, this function is the origin of the vulnerability as it creates the overly permissive RBAC rules.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.