Cross-Namespace Resource Exposure Vulnerability in OpenFeature Operator by OpenFeature

CVE-2026-54495

What is CVE-2026-54495?

The OpenFeature Operator, utilized to manage feature flags, has a vulnerability in versions 0.9.2 and earlier that allows tenants with controller access to expose sensitive information across namespaces. Specifically, via the openfeature.dev/featureflagsource annotation, unauthorized users can reference feature flag sources or in-process configurations from different namespaces. This issue is particularly critical in multi-tenant clusters that rely on namespaces as trust boundaries, where the cluster-scoped operator inadvertently reads and exposes environment variable values, bearer tokens, and other sensitive configurations to unauthorized workloads. Single-tenant clusters remain insulated from this risk, as local namespace restrictions safeguard configuration values.

References