Radius is a cloud‑native application platform that uses a Kubernetes controller to manage container resources. Before version 0.58.0 the controller deserializes the radapp.io/status annotation on a Deployment and deletes the container identified by the annotation without verifying ownership, allowing an attacker who can write Deployment annotations to point the deletion at a different tenant’s resource. This can lead to the removal of a recoverable container, disrupting service for the affected tenant or, in a single‑tenant installation, causing a self deni­al of service.

The vulnerability affects all releases of the radius‑project product before 0.58.0 that deploy the Kubernetes controller. Users running the radius controller in a multi‑tenant environment are at risk when the controller is enabled, while single‑tenant users are only at risk of self‑induced denial of service. The issue has been fixed in version 0.58.0; no other vendor or product is affected.

The CVSS score of 7.7 reflects a high severity, but no EPSS score is presently available and the vulnerability is not covered in the CISA KEV catalog. Successful exploitation requires write access to Deployment annotations and knowledge of a target container ID, typically privileges that are restricted to administrators or tenant owners. In a multi‑tenant deployment, the attacker could delete another tenant’s recoverable container, producing a disruptive denial of service; in a single‑tenant environment the impact is limited to service interruption for the affected tenant.