7.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32737

CVE-2026-32737: Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod out of it. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. Removing the inter-ns NetworkPolicy patches the vulnerability in version 0.2.1. If updates are not possible in production environments, manually delete inter-ns and update as soon as possible. Given one's context, delete the failing network policy that should be prefixed by inter-ns- in the target namespace.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32737

CVE-2026-32737:

7.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ctfer-io/romeo/environment/deploy	go	< 0.2.1	0.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a misconfigured Kubernetes NetworkPolicy named "inter-ns" that was created by the application's deployment code. The advisory states that this policy, intended to provide network isolation for a 'hardened' namespace, was 'mis-written' and allowed pods within that namespace to communicate with pods in any other namespace, enabling potential lateral movement. The provided commit patch confirms this by removing the code responsible for creating the inter-ns NetworkPolicy.

The analysis of the patch 3bb5e9d9ce1199dfbb90fef8ad79ebdeb0bc5e78 shows the removal of a netwv1.NewNetworkPolicy resource from the provision method within the Hardening struct. This change is present in two separate but identical files: environment/deploy/parts/hardening.go and install/deploy/parts/hardening.go.

The removed code defined an egress policy that selected all pods in the namespace (PodSelector: {}) and allowed traffic (Egress rule) to any namespace whose name was not the current one (Operator: "NotIn"). While the developer's comment indicated an intent to 'deny all traffic to adjacent namespaces', the implementation did the opposite: it explicitly allowed egress traffic to all other namespaces. In a Kubernetes environment where network policies are used to enforce a default-deny stance, this rule effectively created a hole in the firewall.

The vulnerable functions are identified as parts.Hardening.provision in both locations, as they are directly responsible for executing the Pulumi code that defines and creates this flawed NetworkPolicy resource during deployment.

Vulnerable functions

parts.Hardening.provision

environment/deploy/parts/hardening.go

This function was responsible for creating a misconfigured Kubernetes NetworkPolicy named "inter-ns". This policy, intended to isolate the namespace, instead contained a rule that explicitly allowed egress traffic from any pod in the namespace to any pod in any other namespace. This bypasses the intended network isolation, allowing for potential lateral movement from a supposedly hardened environment. The vulnerability was fixed by removing the creation of this faulty NetworkPolicy.

parts.Hardening.provision

install/deploy/parts/hardening.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.