The CTFer.io Monitoring component gathers logs, metrics and traces; a mis‑written NetworkPolicy allowed a malicious actor to pivot from one component to any other Kubernetes namespace. This constitutes an Access Control failure (CWE-284) that directly undermines the expected security‑by‑default posture of the deployment. The vulnerability therefore enables potential lateral movement within the cluster and could expose other services and data to an attacker. (CVE description)

Affected product: ctfer-io monitoring. Any deployment prior to version 0.2.1 is vulnerable, as the fix is included in 0.2.1. (Vendor: ctfer-io:monitoring)

The CVSS score of 7.1 classifies the risk as High. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to gain network access to the monitoring component; from there the flawed NetworkPolicy permits pivoting across namespaces. (SCORES)