Satoqz

An incorrect authorization issue exists in the ACL policy cache. This allows tokens to reference policies from arbitrary namespaces through the use of specially crafted policy names. Consequently, attackers possessing these tokens can acquire the capabilities of cached policies in other namespaces, including the root namespace, enabling them to operate across namespace boundaries.

An improper authorization issue exists where privileged child-namespace tokens can modify plugin registrations. This occurs because the endpoint '/v1/sys/plugins/catalog/*' is not restricted to the root namespace. An attacker can use a child namespace's `sys/` mount to remove existing registrations, create invalid ones, or register installed plugins, which can lead to a denial of service.