CVE-2026-23634
Defenseunicorns Pepr ≤ 1.0.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:NSummary
CVE-2026-23634 is a uncategorised-severity Least Privilege Violation (CWE-272) vulnerability in Defenseunicorns Pepr. Its CVSS base score is 0.0.
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3113
Vulnerability Data
Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not explicitly force or enforce least-privilege guidance for module authors. The default behavior exists to make the “getting started” experience…
more
smooth: new users can experiment with Pepr and create resources dynamically without needing to pre-configure RBAC. This vulnerability is fixed in 1.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
AC-6 directly requires employing least privilege so that elevated rights are granted only when needed and revoked immediately afterward.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy and ongoing review that prevents failure to drop elevated rights after privileged operations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricts and monitors privileged utility programs, directly addressing the need to drop elevated rights immediately after use.
Privileged access rights explicitly require least-privilege assignment and timely revocation after elevated operations.
Secure coding practices can prevent least-privilege violations but do not constitute the control itself.
Information access restriction supports least privilege but does not specifically mandate dropping rights after privileged operations.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 24.04 (1 rule)
- V-270689 Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions. prevents CWE-272
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-272
Windows Server 2022 (1 rule)
- V-254428 Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-272