https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T13:35:06.945581+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-260264 EUVD-2026-260264 2026-10-25T13:35:06.947794+00:00 EUVD-2026-260264 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64171 fkie_cve-2025-64171 2026-10-25T13:35:06.947824+00:00

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is fixed in version 0.13.4.

 https://cve.radiocsirt.org/vuln/ghsa-gf93-xccm-5g6j GHSA-gf93-xccm-5g6j — MARIN3R: Cross-Namespace Vulnerability in the Operator 2026-10-25T13:35:06.947857+00:00

Affected: Go: github.com/3scale-sre/marin3r

## Summary Cross-namespace Secret access vulnerability in DiscoveryServiceCertificate allows users to bypass RBAC and access Secrets in unauthorized namespaces.

## Affected Versions All versions prior to v0.13.4

## Patched Versions v0.13.4 and later

## Impact Users with permission to create DiscoveryServiceCertificate resources in one namespace can indirectly read Secrets from other namespaces, completely bypassing Kubernetes RBAC security boundaries.

## Workarounds Restrict DiscoveryServiceCertificate create permissions to cluster administrators only until patched version is deployed.

## Credit Thanks to @debuggerchen for the responsible disclosure.