CVE-2026-53999 radius-project CVE debrief

Who should care

Defenders of multi-tenant Radius installations should assess exposure and prioritize upgrading to version 0.58.0 or later. They should also review Deployment annotations and container resource identifiers to verify potential impact. Security teams and vulnerability management teams should track exceptions and retest remediated assets.

Why it matters

The Radius controller is vulnerable to a confused-deputy condition, allowing an attacker to delete another team's container resource in a multi-tenant installation. Defenders should prioritize verifying exposure and upgrading to version 0.58.0 or later.

• Potential deletion of another team's recoverable container resource
• Disruption of service in multi-tenant installations
• Self denial of service in single-tenant installations
• Verification of exposure and remediation priority

Technical summary

The Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. This allows an attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID to forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource in multi-tenant installations.

Defensive priority

Defenders should prioritize verifying exposure in multi-tenant installations and upgrading to version 0.58.0 or later.

Recommended defensive actions

• Verify exposure in multi-tenant installations by reviewing Deployment annotations and container resource identifiers.
• Upgrade to version 0.58.0 or later.
• Monitor for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Assign an owner for follow-up on affected product deployments in managed environments.

Evidence notes

The issue is described in the CVE Program record and the NVD vulnerability detail page. The Radius project has provided a security advisory and a fix in version 0.58.0. Defenders should verify exposure by reviewing Deployment annotations and container resource identifiers. They should also confirm the affected scope and assess potential impact on multi-tenant installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.