Is CVE-2026-29773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29773 being exploited in the wild.

How severe is CVE-2026-29773?

Medium severity, with a CVSS score of 4.3, published 10 March 2026.

Which products and versions are affected?

github.com/kubewarden/kubewarden-controller (Go) SEMVER:introduced=0,fixed=1.33.0; Kubewarden Admission Controller 1.6.0 to 1.33.0.

Is there a fix for CVE-2026-29773?

Yes. github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29773 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-29773?

Check whether you run github.com/kubewarden/kubewarden-controller (Go), Kubewarden Admission Controller or Linuxfoundation Kubewarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29773: Kubewarden incorrect authorization in deprecated host-callback APIs

CVE-2026-29773 · Severity: medium · CVSS 4.3 · Published 2026-03-10

Kubewarden is a policy engine used to manage security and compliance within Kubernetes clusters. A vulnerability in certain deprecated components allows users with the ability to create policies to bypass intended security boundaries and read information about other parts of the cluster. While attackers cannot modify data or access sensitive secrets, they can view network routing rules, service names, and internal IP addresses, potentially aiding in further attacks.

Technologies: github.com/kubewarden/kubewarden-controller (Go). Vendors: Go, Linuxfoundation.

Quick answers

Is CVE-2026-29773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29773 being exploited in the wild.
How severe is CVE-2026-29773?: Medium severity, with a CVSS score of 4.3, published 10 March 2026.
Which products and versions are affected?: github.com/kubewarden/kubewarden-controller (Go) SEMVER:introduced=0,fixed=1.33.0; Kubewarden Admission Controller 1.6.0 to 1.33.0.
Is there a fix for CVE-2026-29773?: Yes. github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29773 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-29773?: Check whether you run github.com/kubewarden/kubewarden-controller (Go), Kubewarden Admission Controller or Linuxfoundation Kubewarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.33.0 or later
```
go get github.com/kubewarden/kubewarden-controller@v1.33.0
```

Technical details

A vulnerability exists in the Kubewarden policy-evaluator where three deprecated host-callback APIs (kubernetes/ingresses, kubernetes/namespaces, and kubernetes/services) do not properly enforce namespaced isolation. An attacker with permissions to create or update 'AdmissionPolicy' or 'AdmissionPolicyGroup' resources can craft a malicious policy that invokes these callbacks. This allows the attacker to exfiltrate metadata about cluster resources across all namespaces, including internal topology and routing rules. The issue is rooted in incorrect authorization (CWE-863) within the waPC binding layer. The vulnerability is read-only and does not grant access to Secrets or ConfigMaps. The issue was resolved in version 1.33.0 by removing the deprecated bindings.

Affected products

Kubewarden Kubewarden Admission Controller 1.6.0 to 1.33.0

Identifiers

CVE-2026-29773
GHSA-6r7f-3fwq-hq74
GO-2026-4652

Timeline

2026-02-26: patched: Deprecated WAPC bindings removed in pull request 1519
2026-03-09: advisory: Vendor advisory GHSA-6r7f-3fwq-hq74 published
2026-03-10: disclosed: CVE-2026-29773 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.