Romeo is a Go code coverage tool for GitHub Actions. A mis‑written NetworkPolicy in releases prior to 0.2.1 allows a malicious actor that can reach the hardened namespace to reach any pod outside that namespace. The vulnerability permits lateral movement within a Kubernetes cluster and undermines the default hardening expected when deploying Romeo. The weakness is a lack of proper authorization controls in the NetworkPolicy, classified under CWE‑284 (Access Control).

The affected product is Romeo from ctfer‑io. Any installation of Romeo before version 0.2.1 is vulnerable. The misconfigured NetworkPolicy applies to all namespaces where Romeo is deployed. Versions 0.2.1 and later no longer contain the faulty inter‑ns policy.

The CVSS score of 7.9 indicates high severity. The EPSS score is below 1 %, suggesting that exploitation attempts are unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. However, if an attacker can compromise or inject traffic into the hardened namespace, the mis‑written policy can be exploited via normal Kubernetes networking channels, enabling a pivot to any pod in the cluster. In absence of monitoring or network segmentation, the risk is that compromised namespaces could be used as footholds for further attacks.