High severity · published Mar 13, 2026
CVE-2026-32720
Improper Access Control in github.com/ctfer-io/monitoring
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. This vulnerability is fixed in 0.2.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
monitoring · ctfer-io
< 0.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32720
github.com
https://github.com/ctfer-io/monitoring/security/advisories/GHSA-7x23-j8gv-v54x
More from monitoring
9.8
CVE-2026-32771
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
