Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53999— Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

Quick assessment

Affected
radius-project radius
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Radius 是一个云原生、可移植的应用平台，旨在简化团队开发云原生应用的流程。在 0.58.0 版本之前，Kubernetes 控制器会反序列化由用户控制的 注解（该注解附加在 Deployment 资源上），并使用其中提供的容器资源标识符执行删除操作，而未验证该资源是否确实由该 Deployment 拥有。 攻击者如果具备修改 Deployment 注解的权限，并且知晓目标 Radius 资源的 ID，便可以伪造 注解，将 设置为 ，从而触发对另一租户所管理的 Radius 容器资源的特权删除路径，引发重新协调

CVSS 7.7 · High EPSS 0.34% · P26

Possible ATT&CK Techniques 1 AI

T1565.003 · Runtime Data Manipulation

Affected Version Matrix 1

VendorProduct Version RangeStatus
radius-project radius < 0.58.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53999

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Source: CVE Program / CVE List V5
Vulnerability Description
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
radius-project radius < 0.58.0 -

II. Public POCs for CVE-2026-53999

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53999

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53999 (1)

Other References for CVE-2026-53999 (2)

IV. Related Vulnerabilities

Same weakness: CWE-20

V. Comments for CVE-2026-53999

No comments yet

Leave a comment