CVE-2026-23634CWE-272

Pepr Overly Permissive RBAC ClusterRole in Admin Mode

published January 16, 2026

CVSS v3.1
0.0
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.

The record
Technical detail
CVSS v3.1
0.0 · NONE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-272 · Least Privilege Violation
Published
2026-01-16T19:14Z
EPSS history
Timeline
  • 16 JAN 19:14Z
    Pepr Overly Permissive RBAC ClusterRole in Admin Mode
    cvelistv5