CVE-2026-23634
None · 0.0CVSS
0.0
EPSS
0.2%
Published
Jan 16, 2026
CISA due date
—
The record
Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | pepr | 0 | 1.0.5 |
| npm | pepr | 1.0.0 | 1.0.4 |
Related vulnerabilities
- GHSA-w54x-r83c-x79q Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode Same vulnerability
- CVE-2026-79944 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-272
- CVE-2026-79693 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-272
- CVE-2026-59915 Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least… CWE-272
- CVE-2026-49500 Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper… CWE-272
- CVE-2026-15271 A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG… CWE-272
- CVE-2026-15270 A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. CWE-272
- GHSA-v52w-28xh-v562 Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding… CWE-272