https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:23:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268269 EUVD-2026-268269 https://cve.radiocsirt.org/vuln/euvd-2026-268269 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26055 <p>Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.</p> <p>Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26055 https://cve.radiocsirt.org/vuln/ghsa-965m-v4cc-6334 <p><strong>Affected:</strong> Go: github.com/yokecd/yoke</p> <p># Unauthenticated Admission Webhook Endpoints in Yoke ATC</p> <p>This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.</p> <p>**Recommended CWE**: CWE-306 (Missing Authentication for Critical Function)</p> <p>## Summary</p> <p>Yoke ATC implements multiple Admission Webhook endpoints (`/validations/{airway}`, `/validations/resources`, `/validations/flights.yoke.cd`, `/validations/airways.yoke.cd`, etc.) that process AdmissionReview requests. These endpoints do not implement TLS client certificate authentication or request source validation. Any client that can reach the ATC service within the cluster can send requests directly to these endpoints, bypassing the Kubernetes API Server&#39;s authentication and authorization mechanisms.</p> <p>## Details</p> <p>The vulnerability exists in the HTTP handler implementation where webhook endpoints accept and process requests without verifying the client identity.</p> <p>**Vulnerable Endpoint Handlers** (`cmd/atc/handler.go:147-335`): ```go mux.HandleFunc(&#34;POST /validations/{airway}&#34;, func(w http.ResponseWriter, r *http.Request) { var review admissionv1.AdmissionReview if err := json.NewDecod…</p> <p><strong>Affected:</strong> Go: github.com/yokecd/yoke</p> <p># Unauthenticated Admission Webhook Endpoints in Yoke ATC</p> <p>This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.</p> <p>**Recommended CWE**: CWE-306 (Missing Authentication for Critical Function)</p> <p>## Summary</p> <p>Yoke ATC implements multiple Admission Webhook endpoints (`/validations/{airway}`, `/validations/resources`, `/validations/flights.yoke.cd`, `/validations/airways.yoke.cd`, etc.) that process AdmissionReview requests. These endpoints do not implement TLS client certificate authentication or request source validation. Any client that can reach the ATC service within the cluster can send requests directly to these endpoints, bypassing the Kubernetes API Server&#39;s authentication and authorization mechanisms.</p> <p>## Details</p> <p>The vulnerability exists in the HTTP handler implementation where webhook endpoints accept and process requests without verifying the client identity.</p> <p>**Vulnerable Endpoint Handlers** (`cmd/atc/handler.go:147-335`): ```go mux.HandleFunc(&#34;POST /validations/{airway}&#34;, func(w http.ResponseWriter, r *http.Request) { var review admissionv1.AdmissionReview if err := json.NewDecod…</p> https://cve.radiocsirt.org/vuln/ghsa-965m-v4cc-6334