{"metadata": {"vulnerability": "CVE-2026-53999", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-06-11T16:34:11.635Z", "date_only": false, "value": "2026-06-11T16:34:11.635Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-53999", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-11T23:10:49Z", "date_only": false, "value": "2026-06-11T23:10:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvq", "record": "CVE-2026-53999", "field": "creation_timestamp", "uuid": "a0063ee7-ead9-46eb-a23b-384f79133c2a", "url": "https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvq"}, {"timestamp": "2026-06-12T20:08:46Z", "date_only": false, "value": "2026-06-12T20:08:46Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FP5J-4FJ2-4JVQ", "record": "GHSA-FP5J-4FJ2-4JVQ", "field": "published"}, {"timestamp": "2026-06-12T20:08:46Z", "date_only": false, "value": "2026-06-12T20:08:46Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FP5J-4FJ2-4JVQ", "record": "GHSA-FP5J-4FJ2-4JVQ", "field": "modified"}, {"timestamp": "2026-10-14T18:39:25.344Z", "date_only": false, "value": "2026-10-14T18:39:25.344Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-53999", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:39:25.344Z", "date_only": false, "value": "2026-10-14T18:39:25.344Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-53999", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:17.340Z", "date_only": false, "value": "2026-10-14T19:17:17.340", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-53999", "record": "FKIE_CVE-2026-53999", "field": "published"}, {"timestamp": "2026-10-14T19:42:17.591Z", "date_only": false, "value": "2026-10-14T19:42:17.591600Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-53999", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T19:42:17.591Z", "date_only": false, "value": "2026-10-14T19:42:17.591600Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-53999", "record": "FKIE_CVE-2026-53999", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T19:42:38.965Z", "date_only": false, "value": "2026-10-14T19:42:38.965Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-53999", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:42:38.965Z", "date_only": false, "value": "2026-10-14T19:42:38.965Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-53999", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T00:02:03.200Z", "date_only": false, "value": "2026-10-15T00:02:03.200023Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441988041299020", "record": "CVE-2026-53999", "field": "creation_timestamp", "uuid": "fd71a6d1-9d11-4cb7-a3a6-faeed9e3e84d", "content": "CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership by that Deployment. An attacker with permission to modify Deployment annotations and knowledge of a target Radius resource ID can forge radapp.io/status and set radapp.io/enabled to false, causing reconciliation to enter the privileged deletion path for another tenant's Radius-managed container resource. In a multi-tenant installation this confused-deputy condition can delete another team's recoverable container resource and disrupt service; in a single-tenant installation the impact is limited to self denial of service. The multi-tenant Radius controller reads the annotations in pkg/controller/reconciler/annotations.go and reaches the privileged delete in pkg/controller/reconciler/deployment_reconciler.go. The issue does not disclose data, grant privileges, or provide persistence. This issue is fixed in version 0.58.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-53999https://github.com/radius-project/radius/security/advisories/GHSA-fp5j-4fj2-4jvqhttps://github.com/radius-project/radius/pull/11967https://github.com/radius-project/radius/commit/c4174fc205b838d5eab4f64b4909001ab08c0587https://github.com/radius-project/radius/releases/tag/v0.58.0#radius-project #radius#CVE_2026_53999#bot", "url": "https://infosec.exchange/users/cve/statuses/117441988041299020"}, {"timestamp": "2026-10-16T20:04:29.760Z", "date_only": false, "value": "2026-10-16T20:04:29.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-53999", "record": "FKIE_CVE-2026-53999", "field": "lastModified"}]}