Description
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.
Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.
Published: 2026-07-09
Score: 3.8 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in VMware Pinniped Supervisor allows an attacker who can edit a group’s distinguished name in Active Directory to inject LDAP search parameters, causing the modified group to be returned in the user’s search results. Because Pinniped maps Active Directory groups to Kubernetes cluster roles, the attacker can obtain privileges that exceed those intended for the associated AD identity.

Affected Systems

The flaw is present only in VMware Pinniped Supervisor versions 0.11.0 through 0.46.0 inclusive. The vulnerability applies when the server is running with an ActiveDirectoryIdentityProvider resource that has the groupName setting empty; the fix was introduced in version 0.47.0.

Risk and Exploitability

The CVSS score of 3.8 indicates low severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability can be exploited only if the attacker can edit the DN of a group they belong to, can provide the password of an AD user in that group, and the group search configuration allows the altered DN to be returned. Because of these strict prerequisites, the overall risk to an environment is limited, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on July 28, 2026 at 08:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Pinniped Supervisor version 0.47.0 or later.
  • Set the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName to a non-empty value to block DN modifications from affecting search results.
  • If an upgrade is not possible, disable the ActiveDirectoryIdentityProvider resource or reorganize the group search so that edited DNs are excluded until the fix is applied.

Generated by OpenCVE AI on July 28, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-90

Thu, 23 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-90

Wed, 15 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-90

Sun, 12 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-90

Sat, 11 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-90

Thu, 09 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-90

Thu, 09 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Vmware
Vmware pinniped
Vendors & Products Vmware
Vmware pinniped

Thu, 09 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Description A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.
Title Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries
References
Metrics cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Vmware Pinniped
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-07-09T12:45:41.171Z

Reserved: 2026-07-04T18:13:09.972Z

Link: CVE-2026-59269

cve-icon Vulnrichment

Updated: 2026-07-09T12:45:36.594Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T09:00:06Z

Weaknesses

No weakness.