CVE-2026-44182: enterprise gateway before 3.3.0 (exclusive); +1 more affected products

Affected technology

enterprise gateway · before 3.3.0 (exclusive)
jupyter

enterprise_gateway · < 3.3.0
jupyter-server

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (--- for new documents, ... for end-of-document) to generate multiple resources, potentially creating arbitrary types, such as privileged pods. Vendor/CNA’s CVSS 4.0 assessment (base score 10.0/10) rates confidentiality, integrity and availability impact as high.