High, CVSS 7.7GoPublished
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
CVE-2026-53999 · GHSA-fp5j-4fj2-4jvq
- Affected
- Go github.com/radius-project/radius < 0.58.0
- Fixed in
- 0.58.0· Vendor fix available
- Issue
- Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) Summary A configuration-validation issue in the Radius Kubernetes controller can cause it to issue a DELETE for the container resource referenced by a tampered radapp.io/status annotation on a Deployment. It follows the "Confused Deputy" pattern. Real-world impact is bounded and depends heavily on install topology: in a multi-tenant install (one controller reconciling Deployments across resource groups owned by different teams) it can affect another team's container, while in a single-tenant install it is only self-DoS. There is no data disclosure, no privilege escalation, and no persistence, and deleted resources are recoverable through standard Radius deployment workflows. - Vulnerability Type: Configuration Injection / Cross-Tenant Resource Deletion - CVSS 3.1 Score: 7.7 (High in worst-case multi-tenant installs; Medium or lower in single-tenant or strict-RBAC installs)…
Recommended action: Upgrade to 0.58.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.