PT-2026-25851 · Romeo · Romeo

Virb3 · Publicado 2026-03-16 · Atualizado 2026-03-27 · CVE-2026-32737

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Romeo versions prior to 0.2.1

Description Romeo is a tool designed to measure code coverage for Go applications within GitHub Actions. A misconfigured NetworkPolicy allows a malicious actor to move from the "hardened" namespace to any other Pod, breaking the expected security-by-default behavior and potentially enabling lateral movement. The issue stems from a mis-written NetworkPolicy.

Recommendations Update to version 0.2.1 or later. If updates are not possible, manually delete the inter-ns NetworkPolicy. Delete any failing network policy prefixed by inter-ns- in the target namespace.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-32737

GHSA-FGM3-Q9R5-43V9

GO-2026-4714

SUSE-SU-2026:1135-1

Produtos afetados

Romeo

Referências · 150

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32737.json · Exploit
• https://github.com/ctfer-io/romeo/commit/3bb5e9d9ce1199dfbb90fef8ad79ebdeb0bc5e78 · Correção
• https://github.com/ctfer-io/romeo · Nota
• https://github.com/ctfer-io/romeo/security/advisories/GHSA-fgm3-q9r5-43v9 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33680 · Nota
• https://suse.com/security/cve/CVE-2026-2455 · Nota
• https://suse.com/security/cve/CVE-2026-33679 · Nota
• https://suse.com/security/cve/CVE-2026-33246 · Nota
• https://suse.com/security/cve/CVE-2026-33677 · Nota
• https://suse.com/security/cve/CVE-2026-32720 · Nota
• https://suse.com/security/cve/CVE-2026-24692 · Nota
• https://suse.com/security/cve/CVE-2026-32758 · Nota
• https://suse.com/security/cve/CVE-2026-32606 · Nota
• https://suse.com/security/cve/CVE-2026-24516 · Nota
• https://suse.com/security/cve/CVE-2026-2463 · Nota