—

GO-2026-4714

Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/romeo/environment/deploy

Details

Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace in github.com/ctfer-io/romeo/environment/deploy.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/ctfer-io/romeo/environment/deploy before v0.2.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/ctfer-io/romeo/environment/deploy

Introduced in: 0

No fixed version published yet for github.com/ctfer-io/romeo/environment/deploy (go modules). Pin to a known-safe version or switch to an alternative.

References

https://github.com/ctfer-io/romeo/security/advisories/GHSA-fgm3-q9r5-43v9[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-32737[ADVISORY]
https://github.com/ctfer-io/romeo/commit/3bb5e9d9ce1199dfbb90fef8ad79ebdeb0bc5e78[WEB]