CVE-2026-32769
Critical
Description
Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace. The flawed inter-ns NetworkPolicy breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This issue has been fixed in version 0.1.1. To workaround, delete the failing network policy that should be prefixed by inter-ns- in the target namespace.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCtfer Fullchain
PublishedMar 20, 2026
First seenMar 20, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- ctfer fullchain0.1.1 or later
- github.com/ctfer-io/fullchain0.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ctfer fullchain | v < 0.1.1 | 0.1.1 |
| github.com/ctfer-io/fullchainGo | v < 0.1.1 | 0.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.