Executive brief
A vulnerability in the Radius Kubernetes controller allows an attacker to delete container resources belonging to other teams or tenants. Radius is a platform used to deploy and manage cloud-native applications; in shared environments, this flaw could lead to service outages by allowing one user to trigger the deletion of another user's application components. While no data is stolen, the affected services would become unavailable until redeployed.
Technical details
The Radius controller suffers from a 'Confused Deputy' vulnerability due to improper input validation of the 'radapp.io/status' annotation on Kubernetes Deployments. The controller deserializes user-controllable JSON from this annotation and uses the contained resource IDs to perform DELETE operations via the high-privilege Radius API without verifying if the resource belongs to the tenant owning the Deployment. An attacker with permissions to modify Deployment annotations can inject a malicious resource ID to trigger the deletion of containers in other resource groups. The issue is fixed in version 0.58.0.
Affected products
- radius-project radius < 0.58.0
Timeline
- 2026-06-11: disclosed
- 2026-06-12: advisory: GHSA-fp5j-4fj2-4jvq published
- 2026-06-12: patched: Fixed in version 0.58.0