CVE-2026-32737: Romeo Privilege Escalation Vulnerability

CVE-2026-32737 Overview

Romeo is a Go code coverage tool designed to help measure code coverage for functional and integration tests within GitHub Actions for Go applications (version 1.20 and above). A vulnerability exists in versions prior to 0.2.1 where a mis-written NetworkPolicy allows a malicious actor to pivot from the "hardened" namespace to any Pod outside of it. This breaks the security-by-default property expected as part of the deployment program, enabling potential lateral movement within Kubernetes clusters.

Critical Impact

A malicious actor who gains access to the hardened namespace can exploit the misconfigured inter-ns NetworkPolicy to pivot and access any Pod in other namespaces, potentially compromising the entire Kubernetes cluster through lateral movement.

Affected Products

• Romeo versions prior to 0.2.1
• Go applications using Romeo for code coverage within GitHub Actions
• Kubernetes deployments utilizing Romeo's hardening features

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-32737 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32737

Vulnerability Analysis

This vulnerability stems from an Improper Access Control weakness (CWE-284) in Romeo's Kubernetes deployment configuration. The inter-ns NetworkPolicy was incorrectly written, failing to properly restrict network traffic between namespaces. In Kubernetes environments, NetworkPolicies are crucial for implementing network segmentation and controlling pod-to-pod communication. When these policies are misconfigured, they can inadvertently allow traffic that should be blocked, creating pathways for lateral movement.

The flaw specifically affects the hardening component of Romeo's deployment infrastructure. The intended security model was to isolate pods within the "hardened" namespace from pods in other namespaces. However, due to the policy misconfiguration, this isolation was not enforced, allowing an attacker with a foothold in the hardened namespace to communicate with and potentially compromise pods in any other namespace within the cluster.

Root Cause

The root cause is a mis-written NetworkPolicy resource named inter-ns in the Romeo deployment configuration. The policy was intended to control inter-namespace traffic but failed to properly implement the required restrictions. The security patch removes the internspol (inter-namespace policy) reference entirely from the hardening configuration, as shown in the code changes where the policy declaration was removed from the parts/hardening.go file.

Attack Vector

The attack requires network-based access to the Kubernetes cluster environment where Romeo is deployed. An attacker who has already compromised a pod within the "hardened" namespace can exploit this vulnerability to:

1. Enumerate pods in other namespaces
2. Establish network connections to pods outside the hardened namespace
3. Pivot laterally across the cluster infrastructure
4. Potentially access sensitive data or compromise additional workloads

// Security patch in environment/deploy/parts/hardening.go
// The vulnerable code included an inter-namespace policy reference:

	npol        *netwv1.NetworkPolicy
	dnspol      *netwv1.NetworkPolicy
-	internspol  *netwv1.NetworkPolicy  // REMOVED - This policy was misconfigured
	internetpol *netwv1.NetworkPolicy

Source: GitHub Commit Details

Detection Methods for CVE-2026-32737

Indicators of Compromise

• Unexpected network traffic originating from pods in the "hardened" namespace to pods in other namespaces
• NetworkPolicy objects with names prefixed by inter-ns- in affected namespaces
• Anomalous pod-to-pod communication patterns crossing namespace boundaries
• Authentication attempts or data access from hardened namespace pods to external resources

Detection Strategies

• Audit Kubernetes NetworkPolicy resources for policies prefixed with inter-ns- that may indicate the vulnerable configuration
• Monitor network flow logs for cross-namespace traffic originating from Romeo-managed namespaces
• Review Romeo deployment configurations for versions prior to 0.2.1
• Implement Kubernetes network monitoring to detect lateral movement patterns

Monitoring Recommendations

• Enable Kubernetes audit logging to capture NetworkPolicy changes and cross-namespace access attempts
• Deploy network monitoring solutions capable of inspecting pod-to-pod traffic across namespaces
• Set up alerts for unusual traffic patterns from the hardened namespace to other cluster resources
• Regularly review NetworkPolicy configurations for compliance with security baselines

How to Mitigate CVE-2026-32737

Immediate Actions Required

• Update Romeo to version 0.2.1 or later, which removes the vulnerable inter-ns NetworkPolicy
• If immediate update is not possible, manually delete the inter-ns NetworkPolicy from the deployment
• Identify and delete any NetworkPolicy objects prefixed by inter-ns- in target namespaces
• Audit existing namespace boundaries and pod communication patterns for signs of exploitation

Patch Information

The vulnerability is fixed in Romeo version 0.2.1. The patch removes the invalid inter-ns NetworkPolicy that was allowing unintended cross-namespace traffic. The fix was implemented by removing the internspol reference from the hardening configuration in environment/deploy/parts/hardening.go. For technical details, see the GitHub Security Advisory and commit 3bb5e9d.

Workarounds

• Manually delete the inter-ns NetworkPolicy if upgrading to version 0.2.1 is not immediately feasible
• Delete any failing network policies prefixed by inter-ns- in your target namespaces
• Implement additional NetworkPolicies to explicitly deny cross-namespace traffic as a compensating control
• Consider isolating Romeo-managed namespaces at the cluster level until the patch can be applied

# Configuration example - Remove vulnerable NetworkPolicy
# Delete the inter-ns NetworkPolicy from the affected namespace
kubectl delete networkpolicy inter-ns -n <hardened-namespace>

# Find and delete any policies prefixed with inter-ns- in target namespaces
kubectl get networkpolicy -A | grep "inter-ns-" | awk '{print $1, $2}' | xargs -n2 kubectl delete networkpolicy -n