radius-project CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH radius-project CVE published 2026-10-14

CVE-2026-53999

The Radius controller is vulnerable to a confused-deputy condition. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. This issue is fixed in version 0.58.0.