CVE-2026-59269
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in Pinniped Supervisor allows a user authenticating to Kubernetes clusters to gain elevated privileges. This requires an ActiveDirectoryIdentityProvider with an empty groupName field and the attacker's ability to modify group distinguished names (DN) in Active Directory.
Risk Assessment
The organization faces a risk of privilege escalation in Kubernetes clusters, potentially leading to unauthorized access to resources and cluster takeover.
Recommendation
Immediately upgrade Pinniped to version v0.47.0 or later. Additionally, ensure the groupName field in the ActiveDirectoryIdentityProvider configuration is not empty.
Original NVD description (English source)
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.