CVE-2026-32737: Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

March 16, 2026 (updated March 19, 2026)

Due to a mis-written NetworkPolicy, a malicious actor can pivot from the “hardened” namespace to any Pod out of it. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement.

References

github.com/advisories/GHSA-fgm3-q9r5-43v9
github.com/ctfer-io/romeo
github.com/ctfer-io/romeo/commit/3bb5e9d9ce1199dfbb90fef8ad79ebdeb0bc5e78
github.com/ctfer-io/romeo/security/advisories/GHSA-fgm3-q9r5-43v9
nvd.nist.gov/vuln/detail/CVE-2026-32737

Code Behaviors & Features

Detect and mitigate CVE-2026-32737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →