High 7.7Published Oct 14, 2026

CVE-2026-53999Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects radius-project radius. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.34%, higher than 26% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for radius-project radius

Exploited in the last 30 days

Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.

CVSS: 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness (CWE): CWE-20, CWE-441
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.34% (percentile 26)
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

radius-project radius radius_project:radius (from the name)	before 0.58.0	CNA record

References

https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvqx-refsource-confirm
https://github.com/radius-project/radius/pull/11967x-refsource-misc
https://github.com/radius-project/radius/commit/c4174fc205b838d5eab4f64b4909001ab08c0587x-refsource-misc
https://github.com/radius-project/radius/releases/tag/v0.58.0x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.