Pepr, a type-safe Kubernetes middleware, defaults to a cluster‑admin RoleBasedAccessControl configuration for versions prior to 1.0.5. This default grants any module author or user who deploys Pepr complete cluster‑level privileges without enforcing least‑privilege guidance. The vulnerability allows an attacker or rogue module to gain unrestricted control over the Kubernetes cluster, enabling actions such as creating, modifying, or deleting any resource. The weakness is identified as improper privilege management (CWE‑272).

The affected product is Pepr by Defense Unicorns. Versions up to and including 1.0.4 possess this permissive default RBAC setting and are consequently vulnerable. Users deploying any earlier release must review their RBAC configuration after upgrading to 1.0.5.

The risk is significant due to the full cluster‑admin privileges granted by default. While no CVSS score is provided, the EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can deploy or influence Pepr modules—such as developers or CI/CD pipelines with cluster access—could exploit this flaw by simply enabling module execution, thereby inheriting cluster‑admin rights. The vulnerability remains exploitable until the user applies the fix in 1.0.5 or takes alternative measures to restrict RBAC.