External risk intelligence

MaaS API Header Forgery Allows Unauthorized Access and Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-14450

This vulnerability is an internal network issue involving pod-to-pod communication within a Kubernetes cluster. It requires an attacker to already have a foothold inside the cluster to bypass the internal gateway. It is not an internet-facing service or an edge component, and it is not reachable from the public internet in normal deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the MaaS API allows internal applications to bypass authentication controls, potentially leading to unauthorized access and privilege escalation within the cluster. The vulnerability stems from the API trusting specific forged HTTP headers, which could enable an attacker to gain elevated permissions and access sensitive configurations.

Internal API flaw bypasses security checks.
Could grant unauthorized access and escalate privileges.
Confirm relevance and scope of potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker within a Kubernetes cluster can bypass security checks by sending specially crafted HTTP headers to the MaaS API. This allows them to impersonate other users, leading to unauthorized actions like creating credentials for other namespaces or stealing sensitive information.

Attacker must have cluster access.
Forged HTTP headers trigger bypass.
Unauthorized access and data theft.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow any pod within a cluster to bypass the MaaS API's authentication gateway by forging specific HTTP headers. This could lead to unauthorized access, privilege escalation, the minting of Kubernetes ServiceAccount tokens in other tenants' namespaces, the revocation of API keys, and the exfiltration of sensitive model access configurations.

Tenant namespaces and API keys at risk.
Unauthorized pods forge trusted headers.
Unauthorized access and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MaaS API flaw impacting Kuadrant AuthPolicy gateways suggests that platform or infrastructure teams managing Kubernetes clusters and API gateways are likely responsible for addressing this vulnerability. The first practical step involves identifying all instances of the MaaS API within the cluster, determining their exposure and criticality, and then locating the specific application or service owners who rely on these APIs. Remediation planning should then prioritize based on the identified risks and business impact.

Platform or infrastructure teams own resolution.
Verify MaaS API reachability and criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MaaS API and why is it used?

The MaaS API is a service typically deployed within Kubernetes clusters to manage model access configurations. It acts as an interface that relies on a Kuadrant AuthPolicy gateway to verify user identity and group membership before allowing requests, facilitating secure interactions with internal resources.

What does CWE-290 mean for CVE-2026-14450?

CWE-290 refers to 'Authentication Bypass by Spoofing.' In the context of CVE-2026-14450, it means the API incorrectly trusts specific HTTP headers—like username and group identifiers—provided by the requester. Because it accepts these forged headers at face value without verification, an attacker can impersonate any user to bypass security controls.

How is this vulnerability triggered?

An attacker triggers this flaw by sending HTTP requests with forged headers, specifically 'X-MaaS-Username' and 'X-MaaS-Group,' to the MaaS API from within a Kubernetes cluster. Importantly, requests that do not include these specific, manipulated headers will not bypass the authentication gateway, and external traffic from outside the cluster cannot trigger this bug directly.

Is CVE-2026-14450 an internet-facing threat?

According to Halo Surface Signal, this is an internal network issue. Because it requires a foothold inside the Kubernetes cluster to perform pod-to-pod communication, it is not reachable from the public internet in standard deployments and is classified as very unlikely to be exposed to external actors.

Do I need to take action if I run the MaaS API?

Yes. You should begin by locating all instances of the MaaS API within your clusters to understand where it is running. Identify which services or teams rely on it, assess the criticality of those specific deployments, and coordinate with the relevant service owners to plan and apply the necessary infrastructure updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.