CVE-2026-32737 is a mis-written Kubernetes NetworkPolicy in Romeo (ctfer-io/romeo), scored CVSS 10.0 by NVD. A subverted workload can pivot to pods outside its namespace. Upgrade to 0.2.1, or delete the inter-ns policy if you cannot update yet. The advisory workaround is a single deletion, which makes it quick to apply.
What's affected
The GitHub advisory lists the Go module github.com/ctfer-io/romeo/environment/deploy, versions before v0.2.1, with v0.2.1 as the patched version. Romeo helps measure code coverage for Go functional and integration tests in GitHub Actions.
The advisory calls the NetworkPolicy named with an inter-ns prefix mis-written. It breaks the security by default behavior the deployment is meant to give, which opens the way to lateral movement inside the cluster. The advisory scores the issue High 7.9; NVD scores it 10.0.
How to check if you're exposed
List the policies in your cluster and look for the inter-ns prefix:
kubectl get networkpolicy -A | grep inter-ns
Then check which version of Romeo you deployed, using the image tag or module version in your deployment files. Anything before 0.2.1 is affected.
What to do now
- Upgrade Romeo to 0.2.1 or later and redeploy.
- If you cannot upgrade yet, delete the failing inter-ns policy in the affected namespaces. The advisory says removing it patches the issue.
- Review other NetworkPolicies in the cluster to confirm default deny rules still apply where you expect them.
- Check for unexpected connections between namespaces in your flow logs if you have them.
Why it matters
The class is CWE-284, improper access control. NetworkPolicies are the cluster's internal firewall. When a policy is written too loosely, it can permit traffic that the rest of the design assumed was blocked.
This kind of bug is easy to miss, because everything works and nothing errors. Only a test that tries to cross the boundary shows the gap. The record's KEV flag is false.
Quick check
Does deleting the policy fix it?
The advisory says removing the inter-ns policy patches the vulnerability, and recommends it as a workaround if you cannot upgrade.
Sources
Last reviewed: 19 October 2026.
