A misconfigured NetworkPolicy in Chall‑Manager versions before 0.6.5 allows an attacker that can access an instance pod to reach any pod outside the originating namespace. This violation of security‑by‑default isolation can enable lateral movement, potentially granting access to sensitive data or services within the cluster. The vulnerability is an improper authorization weakness (CWE‑284).

The vulnerability affects ctfer‑io Chall‑Manager, specifically all deployments running a version earlier than 0.6.5. Any instance of this platform subject to the default NetworkPolicy configuration is susceptible.

The CVSS score of 7.9 indicates high severity, yet the EPSS score of less than 1% suggests low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require presence within the same Kubernetes cluster and ability to run or interact with a Chall‑Manager instance; once achieved, the attacker can pivot to other pods due to the broken namespace isolation.