CVE-2026-32737: Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

March 16, 2026 (updated March 19, 2026)

Due to a mis-written NetworkPolicy, a malicious actor can pivot from the “hardened” namespace to any Pod out of it. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement.

References

github.com/advisories/GHSA-fgm3-q9r5-43v9
github.com/ctfer-io/romeo
github.com/ctfer-io/romeo/commit/3bb5e9d9ce1199dfbb90fef8ad79ebdeb0bc5e78
github.com/ctfer-io/romeo/security/advisories/GHSA-fgm3-q9r5-43v9
nvd.nist.gov/vuln/detail/CVE-2026-32737

Code Behaviors & Features

Detect and mitigate CVE-2026-32737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →