CVE-2026-32768 is a mis-written Kubernetes NetworkPolicy in Chall-Manager (ctfer-io/chall-manager), scored CVSS 9.9 by NVD. A subverted workload can pivot to pods outside its namespace. Upgrade to 0.6.5, or delete the inter-ns policy if you cannot update yet. The advisory workaround is a single deletion, which makes it quick to apply.
What's affected
The GitHub advisory lists the Go modules deploy and sdk under github.com/ctfer-io/chall-manager, versions before v0.6.5, with v0.6.5 as the patched version. The advisory adds that the sdk Kompose helper does not isolate instances in the affected versions.
The advisory calls the NetworkPolicy named with an inter-ns prefix mis-written. It breaks the security by default behavior the deployment is meant to give, which opens the way to lateral movement inside the cluster. The advisory scores the issue High 7.9; NVD scores it 9.9.
How to check if you're exposed
List the policies in your cluster and look for the inter-ns prefix:
kubectl get networkpolicy -A | grep inter-ns
Then check which version of Chall-Manager you deployed, using the image tag or module version in your deployment files. Anything before 0.6.5 is affected.
What to do now
- Upgrade Chall-Manager to 0.6.5 or later and redeploy.
- If you cannot upgrade yet, delete the failing inter-ns policy in the affected namespaces. The advisory says removing it patches the issue.
- Review other NetworkPolicies in the cluster to confirm default deny rules still apply where you expect them.
- Check for unexpected connections between namespaces in your flow logs if you have them.
Why it matters
The class is CWE-284, improper access control. NetworkPolicies are the cluster's internal firewall. When a policy is written too loosely, it can permit traffic that the rest of the design assumed was blocked.
This kind of bug is easy to miss, because everything works and nothing errors. Only a test that tries to cross the boundary shows the gap. The record's KEV flag is false.
Quick check
Does deleting the policy fix it?
The advisory says removing the inter-ns policy patches the vulnerability, and recommends it as a workaround if you cannot upgrade.
Sources
Last reviewed: 19 October 2026.
