{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T03:21:20.295","vulnerabilities":[{"cve":{"id":"CVE-2026-29773","sourceIdentifier":"security-advisories@github.com","published":"2026-03-10T17:39:03.210","lastModified":"2026-03-11T13:53:47.157","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation. An attacker with privileged \"AdmissionPolicy\" create permissions (which isn't the default) could make use of 3 deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, kubernetes/services. The attacker can craft a policy that exercises these deprecated API calls and would allow them read access to Ingresses, Namespaces, and Services resources respectively. \nThis attack is read-only, there is no write capability and no access to Secrets, ConfigMaps, or other resource types beyond these three."},{"lang":"es","value":"Kubewarden es un motor de políticas para Kubernetes. Los operadores de clúster de Kubewarden pueden otorgar permisos a los usuarios para desplegar AdmissionPolicies y AdmissionPolicyGroups con ámbito de nombre de espacio en sus Namespaces. Una de las promesas de Kubewarden es que los usuarios configurados pueden desplegar políticas con ámbito de nombre de espacio de manera segura, sin escalada de privilegios. Un atacante con permisos privilegiados de creación de 'AdmissionPolicy' (lo cual no es el valor predeterminado) podría hacer uso de 3 API de devolución de llamada de host obsoletas: kubernetes/ingresses, kubernetes/namespaces, kubernetes/services. El atacante puede elaborar una política que utilice estas llamadas a la API obsoletas y les permitiría acceso de lectura a los recursos Ingresses, Namespaces y Services respectivamente.\nEste ataque es de solo lectura, no hay capacidad de escritura y no hay acceso a Secrets, ConfigMaps u otros tipos de recursos más allá de estos tres."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/kubewarden/kubewarden-controller/commit/4e41b60ae44902d82d94101bac93fb77cae65651","source":"security-advisories@github.com"},{"url":"https://github.com/kubewarden/kubewarden-controller/pull/1519","source":"security-advisories@github.com"},{"url":"https://github.com/kubewarden/kubewarden-controller/security/advisories/GHSA-6r7f-3fwq-hq74","source":"security-advisories@github.com"}]}}]}