CVE-2026-59269

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59269", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-07-04T18:13:09.972Z", "datePublished": "2026-07-09T07:12:10.791Z", "dateUpdated": "2026-07-09T12:45:41.171Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-07-09T07:12:10.791Z"}, "title": "Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Potential privilege escalation in Kubernetes clusters via Active Directory LDAP group DN confusion, under narrow, specific configuration conditions."}]}], "affected": [{"vendor": "VMware", "product": "Pinniped", "versions": [{"status": "affected", "version": "0.11.0", "versionType": "custom", "lessThanOrEqual": "0.46.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.\nAffected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.<br>Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0."}]}], "references": [{"url": "https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "LOW", "baseScore": 3.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T12:45:32.426360Z", "id": "CVE-2026-59269", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T12:45:41.171Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59269", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-07-04T18:13:09.972Z", "datePublished": "2026-07-09T07:12:10.791Z", "dateUpdated": "2026-07-09T12:45:41.171Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-07-09T07:12:10.791Z"}, "title": "Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Potential privilege escalation in Kubernetes clusters via Active Directory LDAP group DN confusion, under narrow, specific configuration conditions."}]}], "affected": [{"vendor": "VMware", "product": "Pinniped", "versions": [{"status": "affected", "version": "0.11.0", "versionType": "custom", "lessThanOrEqual": "0.46.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.\nAffected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.<br>Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0."}]}], "references": [{"url": "https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "LOW", "baseScore": 3.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T12:45:32.426360Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T12:45:36.594Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pinniped", "vendor": "VMware", "versions": [{"lessThanOrEqual": "0.46.0", "status": "affected", "version": "0.11.0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.\nAffected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0."}, {"lang": "es", "value": "Un usuario que se autentica en cl\u00fasteres de Kubernetes a trav\u00e9s del Supervisor de Pinniped podr\u00eda obtener permisos elevados en los cl\u00fasteres, solo si se cumplieran todas las siguientes condiciones: el servidor del Supervisor de Pinniped est\u00e1 ejecut\u00e1ndose con un recurso ActiveDirectoryIdentityProvider configurado; el ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName est\u00e1 vac\u00edo; el atacante obtiene la capacidad de editar alguna parte del nombre distinguido (DN) de las entradas de grupo en la base de datos del servidor de Active Directory (AD) para los grupos a los que pertenece; los par\u00e1metros de b\u00fasqueda de grupo configurados hacen que el grupo editado se incluya en los resultados de b\u00fasqueda de grupo para el usuario; y el atacante conoce la contrase\u00f1a de un usuario de AD que pertenece al grupo de AD editado.\nVersiones afectadas: Pinniped (go.pinniped.dev) v0.11.0 hasta v0.46.0 inclusive; corregido en v0.47.0."}], "id": "CVE-2026-59269", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59269", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T12:45:32.426360Z", "version": "2.0.3"}}]}, "published": "2026-07-09T08:16:49.093", "references": [{"source": "security@vmware.com", "url": "https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.11.0,0.46.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Pinniped", "source": "cna", "vendor": "VMware"}, "product": "pinniped", "vendor": "vmware"}], "created": "2026-07-09T09:45:04.408824+00:00", "updated": "2026-08-05T03:00:13.321868+00:00", "vendors": ["vmware", "vmware$PRODUCT$pinniped"], "weaknesses": ["CWE-285"]}