CVE-2026-54495 open-feature CVE debrief

Who should care

Cluster administrators and security teams managing multi-tenant clusters with OpenFeature Operator, especially those using namespaces as trust boundaries, should assess their cluster configuration, verify workload creation and namespace access controls, and review annotation usage in workloads to limit potential exposure. Security teams should also verify the OpenFeature Operator version and assess the exposure of FeatureFlagSource and InProcessConfigur

Why it matters

CVE-2026-54495 allows tenants to access FeatureFlagSource or InProcessConfiguration resources across namespaces in multi-tenant clusters using OpenFeature Operator version 0.9.2 or earlier, potentially leading to unintended data exposure.

• Verify cluster configuration and OpenFeature Operator version
• Assess exposure of FeatureFlagSource and InProcessConfiguration resources
• Review and limit annotation usage in workloads
• Limit access to sensitive data in FeatureFlagSource resources

Technical summary

CVE-2026-54495 allows tenants to access FeatureFlagSource or InProcessConfiguration resources across namespaces in multi-tenant clusters using OpenFeature Operator version 0.9.2 or earlier. The cluster-scoped operator reads and materializes spec.envVars literal values, spec.httpSyncBearerToken, sync URIs, and supporting ConfigMaps into the tenant's workload, potentially leading to unintended data exposure. This issue is particularly concerning in multi-tenant clusters where namespaces are used as trust boundaries. Single-tenant clusters are not impacted.

Defensive priority

Assess exposure in multi-tenant clusters using OpenFeature Operator version 0.9.2 or earlier

Recommended defensive actions

• Assess cluster configuration and OpenFeature Operator version
• Verify workload creation and namespace access controls
• Review and limit annotation usage in workloads
• Verify cluster configuration and OpenFeature Operator version
• Assess exposure of FeatureFlagSource and InProcessConfiguration resources
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.