VMware Pinniped up to 0.46.0 Group Search active_directory_identity_provider_types.go groupName input validation

Summaryinfo

A vulnerability, which was classified as very critical, has been found in VMware Pinniped up to 0.46.0. This issue affects some unknown processing of the file pkg/apis/identityprovider/v1alpha1/active_directory_identity_provider_types.go of the component Group Search Handler. This manipulation of the argument groupName causes input validation. This vulnerability is handled as CVE-2026-59269. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in VMware Pinniped up to 0.46.0. It has been declared as very critical. Affected by this vulnerability is an unknown functionality of the file pkg/apis/identityprovider/v1alpha1/active_directory_identity_provider_types.go of the component Group Search Handler. The manipulation of the argument groupName with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-59269 since 07/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/09/2026).

Upgrading to version 0.47.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• VMware

Name

• Pinniped

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46.0

License

• commercial

Website

• Vendor: https://www.vmware.com/
• Product: https://github.com/vmware/pinniped/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion