NPM · AUGUST 2026 · EARLY WARNING

MaaS API Vulnerability CVE-2026-14450: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.9
Affected component
cve-2026-14450 (npm)
Patched version
Not yet available
CVE-2026-14450

An early warning has been issued for a critical vulnerability in the MaaS API, tracked as CVE-2026-14450. This flaw allows unauthorized access and privilege escalation.

What happened

A critical flaw has been identified in the MaaS API, tracked under CVE-2026-14450. This vulnerability permits any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`. These headers are trusted verbatim, leading to a lack of first-party authentication. Consequently, an attacker could gain unauthorized access and escalate privileges. The issue is under investigation, and no exploitation in the wild has been confirmed yet.

The vulnerability was first flagged on 2026-08-10T21:17:19.487000+00:00. The CVSS score is 9.9, indicating a critical severity level. The affected component is the MaaS API, but no authoritative version range has been published. Users are advised to upgrade to the latest version of the MaaS API and review access controls for the Kuadrant AuthPolicy gateway.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If cve-2026-14450 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using the MaaS API, you may be affected. No authoritative version range has been published yet, so it is recommended to upgrade to the latest version as a precaution.

What should I do right now?

Upgrade to the latest version of the MaaS API and review your access controls for the Kuadrant AuthPolicy gateway. Monitor the NVD page for CVE-2026-14450 for updates.

Is there an official fix available?

No official fix has been published yet. Continue to monitor the sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats