CVE-2026-53999

Name of the Vulnerable Software and Affected Versions Radius versions 0.57.1 and earlier

Description A configuration-validation issue in the Radius Kubernetes controller allows for a Confused Deputy attack. The controller deserializes JSON data from the radapp.io/status annotation on Kubernetes Deployments without validating if the resource IDs belong to the current tenant. Because the controller uses high-privilege credentials to communicate with the Radius API, an attacker with permission to modify Deployment annotations can inject a malicious radapp.io/status annotation to trigger the deletion of container resources belonging to other tenants in multi-tenant installations. In single-tenant installations, this results in a self-denial of service. The issue involves the deleteContainer() function, which directly uses the container variable from the injected annotation to perform the deletion.

Recommendations For versions 0.57.1 and earlier, implement validation logic to ensure the container ID in the radapp.io/status annotation belongs to the current namespace or tenant. As a temporary mitigation, use Kubernetes RBAC to restrict permissions for modifying Deployment annotations. Monitor modifications to the radapp.io/status annotation for resource IDs belonging to other tenants. Implement strict network policies in multi-tenant environments to isolate traffic.