CVE-2026-53999

Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...

CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...

EUVD-2026-101606

Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...

CVE-2026-53999

The Radius Kubernetes controller (versions 0.57.1 and earlier) is vulnerable to a Confused Deputy attack due to improper input validation in the deserialization of the radapp.io/status annotation on Kubernetes Deployments. The controller fails to verify if the resource IDs provided in this user-c...