ctfer-io chall-manager up to 0.6.4 access control

Summaryinfo

A vulnerability was found in ctfer-io chall-manager up to 0.6.4. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to access control. This vulnerability is traded as CVE-2026-32768. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ctfer-io chall-manager up to 0.6.4 and classified as critical. This issue affects an unknown function. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. In the specific case of sdk/kubernetes.Kompose it does not isolate the instances. This issue has been fixed in version 0.6.5.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-32768 since 03/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 0.6.5 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch dc5ef27dfed2befef7f506ab8ca14d062b0d79c5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ctfer-io

Name

• chall-manager

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4

License

• open-source

Website

• Product: https://github.com/ctfer-io/chall-manager/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion