{"id":"CVE-2026-53999","title":"Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps","summary":"Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a …","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-20","CWE-441"],"vendor":"radius-project","product":"github.com/radius-project/radius","affected":["github.com/radius-project/radius < 0.58.0"],"patched":["github.com/radius-project/radius 0.58.0"],"published":"2026-10-14","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:04:29.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53999","references":[{"url":"https://github.com/radius-project/radius/commit/c4174fc205b838d5eab4f64b4909001ab08c0587","label":"security-advisories@github.com"},{"url":"https://github.com/radius-project/radius/pull/11967","label":"security-advisories@github.com"},{"url":"https://github.com/radius-project/radius/releases/tag/v0.58.0","label":"security-advisories@github.com"},{"url":"https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvq","label":"security-advisories@github.com"},{"url":"https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvq","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-fp5j-4fj2-4jvq"}],"tags":["nvd","ghsa","go","cve.org","exploit-available"],"epss":0.0034,"epssPercentile":0.27381,"aliases":["GHSA-fp5j-4fj2-4jvq"],"ecosystem":"go","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-14T19:42:17.591600Z"},"ingestedAt":"2026-07-07T15:41:59.002Z","slug":"CVE-2026-53999","body":"## Overview\n\nRadius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53999)\n\nAffected packages:\n\n- `github.com/radius-project/radius < 0.58.0`\n\nPatched in:\n\n- `github.com/radius-project/radius 0.58.0`\n\nSource: https://github.com/advisories/GHSA-fp5j-4fj2-4jvq","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":221890,"id":"CVE-2026-53999","ts":1792035895863,"field":"exploit_available","old":"false","new":"true"}]}