Is CVE-2026-29773 actively exploited?

No active exploitation of CVE-2026-29773 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-29773 be exploited remotely?

Yes. CVE-2026-29773 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-29773?

CVE-2026-29773 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-29773

MEDIUM

CVE-2026-29773

CWE-863Published: March 10, 2026· Updated: Mar 11, 2026

4.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.2th

Official Description

Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation. An attacker with privileged "AdmissionPolicy" create permissions (which isn't the default) could make use of 3 deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, kubernetes/services. The attacker can craft a policy that exercises these deprecated API calls and would allow them read access to Ingresses, Namespaces, and Services resources respectively.

This attack is read-only, there is no write capability and no access to Secrets, ConfigMaps, or other resource types beyond these three.

NVD Source

Technical Analysis

CVE-2026-29773 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.