Threats tagged 'ghsa-6vf6-rmwh-84qg'

A critical vulnerability (CVE-2026-14450) exists in the MaaS API that allows any pod within a Kubernetes cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers (X-MaaS-Username and X-MaaS-Group). This authentication bypass enables unauthorized access and privilege escalation, including minting Kubernetes ServiceAccount tokens in other tenants' namespaces, revoking API keys, and exfiltrating sensitive configuration data. The vulnerability has a CVSS score of 9.9 and is classified as an authentication bypass (CWE-290).