CVE-2026-54495

Name of the Vulnerable Software and Affected Versions OpenFeature Operator versions prior to 0.9.3

Description On multi-tenant clusters using namespaces as trust boundaries, a tenant capable of creating a controller-owned workload can reference a FeatureFlagSource or InProcessConfiguration in a different namespace using the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax. This allows the cluster-scoped operator to read the external resource and expose spec.envVars literal values, spec.httpSyncBearerToken, sync URIs, and associated ConfigMaps within the tenant's workload.

Recommendations Update OpenFeature Operator to version 0.9.3 or later.