CVE-2026-23634: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23634 is a Least Privilege Violation vulnerability in Pepr, a type-safe Kubernetes middleware framework developed by Defense Unicorns. Prior to version 1.0.5, Pepr defaults to a cluster-admin RBAC ClusterRole configuration (rbacMode: "admin") and does not enforce or warn about least-privilege guidance for module authors, potentially leaving production deployments with excessive Kubernetes permissions. The vulnerability was published on January 15, 2026, and affects all Pepr versions before 1.0.5 (GitHub Advisory). It carries a CVSS v3.1 base score of 4.3 (Medium) per Feedly/NVD, though the GitHub Advisory Database rates it Low (1.7 CVSS v4), and the vendor classifies it as Low severity (GitHub Advisory, Pepr Advisory).

The root cause is classified under CWE-272 (Least Privilege Violation) and CWE-276 (Incorrect Default Permissions), located in /workspace/pepr/src/lib/assets/rbac.ts (GitHub Advisory). Pepr's default rbacMode: "admin" grants the deployed controller a cluster-admin ClusterRole binding, which provides unrestricted access to all Kubernetes API resources across the entire cluster. This default was intentionally designed to simplify the onboarding experience for new users running the demo hello-pepr.ts module, but if a module author skips documentation and deploys to production without reconfiguring RBAC, the controller operates with far broader privileges than necessary (Pepr Advisory). This is not a traditional code-execution vulnerability but rather a misconfiguration-by-default that expands the blast radius of any compromise of the Pepr controller.

If a Pepr module is deployed to production with the default cluster-admin RBAC configuration, any compromise of the Pepr controller process — through a separate vulnerability or supply chain attack — would grant an attacker full control over the Kubernetes cluster, including the ability to read secrets, modify workloads, create privileged pods, and perform lateral movement across all namespaces (Pepr Advisory). The integrity impact is the primary concern, as an attacker leveraging the over-permissioned service account could modify any Kubernetes resource cluster-wide. Confidentiality is also at risk since cluster-admin access allows reading all Secrets, ConfigMaps, and other sensitive resources across namespaces (GitHub Advisory).

This vulnerability is not directly exploitable in isolation — it requires a secondary attack vector (e.g., compromising the Pepr controller) to leverage the excessive permissions (Pepr Advisory). There is no known public exploit code, no evidence of in-the-wild exploitation, and no threat actor attribution. The EPSS score is approximately 0.017% (4th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Defense Unicorns released Pepr version 1.0.5 on January 15, 2026, which adds a log warning when the default cluster-admin ClusterRole is in use, alerting operators that it is not recommended for production (Pepr Release). The primary remediation is to upgrade to Pepr 1.0.5 or later and scope RBAC appropriately before any production deployment. Module authors should run npx pepr build --rbac-mode=scoped to generate the minimum required RBAC permissions for the controller and informer, then add only the specific permissions needed for their module's Kubernetes resource operations (GitHub Advisory).

The vendor (Defense Unicorns) published a detailed advisory explaining the design rationale and explicitly classifying the issue as low severity, noting that the cluster-admin default is intentional for developer onboarding and that production guidance is documented (Pepr Advisory). The fix was described as adding a log warning rather than changing the default behavior, reflecting the vendor's position that module authors bear responsibility for RBAC scoping. No significant broader media coverage or notable researcher commentary beyond the advisory itself was identified.