{"id":"CVE-2026-53999","summary":"Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)","details":"Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.","aliases":["GHSA-fp5j-4fj2-4jvq","GO-2026-5373"],"modified":"2026-10-16T02:47:51.268643705Z","published":"2026-10-14T18:39:25.344Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53999.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-441"]},"references":[{"type":"WEB","url":"https://github.com/radius-project/radius/releases/tag/v0.58.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53999.json"},{"type":"ADVISORY","url":"https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53999"},{"type":"FIX","url":"https://github.com/radius-project/radius/commit/c4174fc205b838d5eab4f64b4909001ab08c0587"},{"type":"FIX","url":"https://github.com/radius-project/radius/pull/11967"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radius-project/radius","events":[{"introduced":"0"},{"fixed":"c4174fc205b838d5eab4f64b4909001ab08c0587"},{"fixed":"d8289818dc121527659b781707500a1c9d46c2fe"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.58.0"}]}}],"versions":["v0.58.0-rc1","v0.57.0-rc1","v0.56.0-rc3","v0.56.0-rc2","v0.56.0-rc1","v0.55.0-rc5","v0.55.0-rc4","v0.55.0-rc3","v0.55.0-rc1","v0.54.0-rc1","v0.53.0-rc1","v0.52.0-rc1","v0.51.0-rc1","v0.50.0-rc5","v0.50.0-rc4","v0.50.0-rc2","v0.49.0-rc1","v0.48.0-rc1","v0.47.0-rc1","v0.46.0","v0.46.0-rc3","v0.46.0-rc2","v0.46.0-rc1","v0.45.0-rc1","v0.44.0-rc1","v0.43.0-rc1","v0.42.0-rc1","v0.41.0-rc1","v0.40.0-rc1","v0.39.0-rc1","v0.38.0-rc1","v0.37.0-rc1","v0.36.0-rc1","v0.35.0-rc1","v0.34.0-rc1","v0.33.0-rc1","v0.32.0-rc1","v0.31.0-rc1","v0.30.0-rc3","v0.29.0-rc1","feature_radcli_0.1.0","v0.28.0-rc1","v0.27.0-rc1","v0.26.0-rc1","v0.25.0-rc1","v0.24.0-rc1","v0.23.0-rc1","v0.23.0","v0.22.0-rc1","v0.21.0-rc1","v0.20.0","show","v0.20.0-rc1","v0.19.0-rc2","v0.19.0","v0.19.0-rc1","v0.18.0-rc2","v0.18.0","v0.18.0-rc1","v0.17.0-rc1","delete","v0.16.0","v0.16.0-rc1","v0.15.0","v0.15.0-rc2","v0.15.0-rc1","v0.14.0-rc2","v0.14.0","v0.14.0-rc1","list","v0.13.0","v0.13.0-rc1","v0.12.0-rc4","v0.12.0-rc3","v0.12.0-rc2","v0.12.0-rc1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.0","v0.6.0","v0.5.1","v0.5.0","v0.4.0","v0.3.0","v0.2.0","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53999.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}]}