CVE-2026-32769: Fullchain CTF Privilege Escalation Flaw

CVE-2026-32769 Overview

Fullchain is an umbrella project for deploying a ready-to-use CTF (Capture The Flag) platform on Kubernetes infrastructure. A critical misconfiguration in the inter-namespace NetworkPolicy implementation in versions prior to 0.1.1 allows malicious actors who have compromised an application within the cluster to pivot from a subverted pod to any other pod outside the originating namespace.

Critical Impact

The flawed inter-namespace NetworkPolicy breaks the security-by-default property expected as part of the deployment program, enabling potential lateral movement across the entire Kubernetes cluster.

Affected Products

• Fullchain CTF Platform versions prior to 0.1.1
• Kubernetes deployments using the vulnerable inter-ns NetworkPolicy configuration
• Organizations running Fullchain-deployed CTF environments

Discovery Timeline

• March 20, 2026 - CVE-2026-32769 published to NVD
• March 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32769

Vulnerability Analysis

This vulnerability stems from a mis-written Kubernetes NetworkPolicy that fails to properly enforce namespace isolation. The flaw is categorized under CWE-284 (Improper Access Control), which encompasses security controls that fail to restrict access appropriately.

The vulnerability allows an attacker who has already gained a foothold within one pod in the Fullchain deployment to bypass the expected namespace segmentation. Under normal Kubernetes operations, NetworkPolicies act as firewall rules that control pod-to-pod communication. When properly configured, these policies ensure that pods in one namespace cannot communicate with pods in other namespaces unless explicitly permitted.

In this case, the inter-namespace NetworkPolicy was incorrectly written, effectively creating an overly permissive rule set that permits cross-namespace traffic. This breaks the fundamental security model that organizations rely upon when deploying multi-tenant or segmented Kubernetes workloads.

Root Cause

The root cause is an Improper Access Control vulnerability in the inter-namespace (inter-ns-) prefixed NetworkPolicy definitions. The policy rules were misconfigured to allow egress traffic that should have been denied by default. This configuration error effectively negates the namespace isolation that Kubernetes administrators expect when deploying network segmentation policies.

The vulnerability exists because the NetworkPolicy selector or rule specifications were too broad, failing to properly restrict traffic to only intended destinations within the same namespace.

Attack Vector

The attack requires network access and exploits the flawed NetworkPolicy configuration. An attacker must first compromise an application pod within the Fullchain deployment. Once inside, they can leverage the overly permissive network rules to:

1. Enumerate other namespaces and pods in the cluster
2. Establish connections to pods in namespaces outside the original attack surface
3. Pivot laterally to access sensitive services, databases, or control plane components
4. Potentially escalate the attack to affect the broader Kubernetes infrastructure

The attack does not require any privileges or user interaction, though successful exploitation depends on first gaining access to a pod within the affected deployment.

Detection Methods for CVE-2026-32769

Indicators of Compromise

• Unexpected network connections originating from CTF platform pods to services in other namespaces
• Anomalous DNS queries from Fullchain pods attempting to resolve services in unrelated namespaces
• Network flow logs showing egress traffic from CTF pods to internal cluster services outside expected communication patterns

Detection Strategies

• Deploy Kubernetes network monitoring tools to track cross-namespace traffic patterns and alert on anomalies
• Implement audit logging for NetworkPolicy changes and review any modifications to inter-ns- prefixed policies
• Use service mesh observability (Istio, Linkerd) to visualize and alert on unexpected pod-to-pod communication paths
• Regularly validate NetworkPolicy effectiveness using network policy testing tools like netpol-analyzer

Monitoring Recommendations

• Enable Kubernetes audit logs and monitor for policy modifications or suspicious API server activity
• Configure network flow monitoring at the CNI level to detect lateral movement attempts
• Establish baseline communication patterns for Fullchain pods and alert on deviations
• Implement runtime security tools to detect and alert on unexpected network behavior from containerized workloads

How to Mitigate CVE-2026-32769

Immediate Actions Required

• Upgrade Fullchain to version 0.1.1 or later, which contains the corrected NetworkPolicy configuration
• Audit existing NetworkPolicy configurations for overly permissive rules, particularly those prefixed with inter-ns-
• Review cluster network traffic logs to identify any potential exploitation that may have occurred
• Implement additional network segmentation controls while planning the upgrade

Patch Information

The vulnerability has been addressed in Fullchain version 0.1.1. The fix corrects the inter-namespace NetworkPolicy configuration to properly enforce namespace isolation as originally intended. The specific changes can be reviewed in the GitHub commit dbcb90178bcb07a3f5a1efa4c6350f3a6ce34f51.

For additional details, refer to the GitHub Security Advisory GHSA-hxm7-9q36-c77f and the GitHub Release v0.1.1.

Workarounds

• Delete the failing network policy prefixed by inter-ns- in the target namespace as an immediate mitigation
• Implement a deny-all default NetworkPolicy for affected namespaces until the upgrade can be completed
• Use a Kubernetes-native firewall or CNI with enhanced policy enforcement capabilities as an additional layer of defense
• Consider temporarily isolating the affected CTF platform namespace from critical infrastructure until patching is complete

# Delete the vulnerable inter-ns NetworkPolicy (replace with actual namespace and policy name)
kubectl get networkpolicy -n <target-namespace> | grep "inter-ns-"
kubectl delete networkpolicy <inter-ns-policy-name> -n <target-namespace>

# Apply a default deny-all egress policy as a temporary safeguard
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: <target-namespace>
spec:
  podSelector: {}
  policyTypes:
  - Egress
EOF