Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-32768

29
FAUCET Score

CVE-2026-32768 affects Chall-Manager versions prior to 0.6.5, where a misconfigured NetworkPolicy allows a malicious actor to pivot from an instance to any Pod outside its origin namespace, enabling lateral movement. Rated with a CVSS score of 7.9 (High), this vulnerability can be exploited remotely with low attack complexity, breaking expected security isolation and potentially impacting the confidentiality, integrity, and availability of affected systems. There is currently no evidence of active exploitation, nor is public exploit code available. Community discussion and media coverage are minimal, indicating low current attention.

Impacted Technologies

VendorProductVersion(s)CPE
< 0.6.5CPE matchmatch criteria
cpe:2.3:a:ctfer-io:chall-manager:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

7.9HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
NONE
SS Confidentiality
HIGH
SS Integrity
HIGH
SS Availability
HIGH
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.28%
Probability of exploitation in next 30 days
EPSS Percentile
20.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0028 is in the 7th percentile among its peer group of 1,124 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
gopatch availablevia ghsa
Product: github.com/ctfer-io/chall-manager/deployFixed in: 0.6.5
gopatch availablevia ghsa
Product: github.com/ctfer-io/chall-manager/sdkFixed in: 0.6.5

Vendor Advisories (1)

goGHSA-mw24-f3xh-j3qvhigh

Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Mar 16, 2026

References

github.com / ctfer-io/chall-manager/commit/dc5ef27dfed2befef7f506ab8ca14d062b0d79c5
Patch
github.com / ctfer-io/chall-manager/releases/tag/v0.6.5
Release Notes
github.com / ctfer-io/chall-manager/security/advisories/GHSA-mw24-f3xh-j3qv
MitigationVendor Advisory