CVE-2026-59269

Name of the Vulnerable Software and Affected Versions Pinniped (go.pinniped.dev) versions 0.11.0 through 0.46.0

Description A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions. This occurs when the server is configured with an ActiveDirectoryIdentityProvider resource where the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty. An attacker can exploit this if they can edit part of the distinguished name (DN) of group entries in the Active Directory server database for groups they belong to, provided the group search parameters include the edited group and the attacker possesses the password for an AD user within that group.

Recommendations Update to version 0.47.0.