The vulnerability is caused by a mis‑written NetworkPolicy in Fullchain versions prior to 0.1.1. The policy incorrectly permits traffic between Pods in different namespaces, allowing a malicious actor who compromises a Pod in one namespace to reach any Pod in another namespace. This represents an access‑control flaw (CWE‑284) that can lead to lateral movement within the Kubernetes cluster, potentially exposing sensitive data or further compromising cluster resources.

Affected product: ctfer‑io:fullchain. All releases older than 0.1.1 are vulnerable. No specific patch version list is provided other than the note that the issue was fixed in 0.1.1.

The CVSS score of 7.1 indicates a medium‑to‑high severity. EPSS data is unavailable, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Credentialed or successfully compromised application Pods can pivot across namespaces, so the attack vector is cluster‑internal and requires initial access to a compromised Pod. The impact is potential unauthorized data exposure and service disruption within the cluster.