Network Misconfiguration in Romeo Affects Go Applications by ctfer

CVE-2026-32737

What is CVE-2026-32737?

The Romeo tool, designed for measuring code coverage in Go applications, contains a vulnerability due to a misconfigured NetworkPolicy prior to version 0.2.1. This misconfiguration allows a malicious actor to bypass the security measures in place within a 'hardened' namespace, potentially enabling lateral movement to other Pods outside of this protected environment. To mitigate this risk, users should remove the problematic 'inter-ns' NetworkPolicy and promptly upgrade to version 0.2.1 or later. For those unable to update immediately, it is essential to manually delete the 'inter-ns' NetworkPolicy from the target namespace as an interim security measure.

References