Deserialization Vulnerability in Radius Cloud-Native Application Platform

CVE-2026-53999

What is CVE-2026-53999?

The Radius cloud-native application platform exhibits a deserialization vulnerability in versions prior to 0.58.0. This flaw occurs when the Kubernetes controller improperly processes the user-controlled radapp.io/status annotation associated with a Deployment. An attacker with the ability to alter Deployment annotations can exploit this weakness to manipulate radapp.io/status, setting it to radapp.io/enabled: false. This action may trigger a privileged deletion process targeting container resources managed by another tenant within a multi-tenant environment, potentially leading to the unintentional deletion of critical resources and service disruption. In single-tenant scenarios, the risk is limited to self-inflicted denial of service. The vulnerability affects crucial components in the reconciler code that handles the deployment annotations. Upgrade to version 0.58.0 to mitigate this issue.

References