Skip to content
Threat Feed
Subscribe
critical advisory PoC

Burrito: Authentication bypass in webhook processing (CVE-2026-102649)

Burrito Kubernetes operator prior to 0.13.0 fails to verify webhook signatures when the secret is empty, allowing attackers to forge repository events and trigger unauthorized terraform plan operations.

CVE search metadata

CVE search record: CVE-2026-102649. Severity: critical. CVSS: 9.9. KEV: no. Product: Burrito (< 0.13.0). Brief: Burrito: Authentication bypass in webhook processing (CVE-2026-102649). Brief link: https://feed.craftedsignal.io/briefs/2026-10-burrito-auth-bypass/

Triage facts

Revision 2
Applicability
Burrito (< 0.13.0)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 2Oct 26, 21:06 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: has_poc, lastmod, poc_references, references, updates

    Sources: 1

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Versions prior to 0.13.0 contain a vulnerability (CVE-2026-102649) where the POST /api/webhook endpoint fails to authenticate GitHub and GitLab events if a TerraformRepository has no webhookSecret defined. Because the secret is optional, the underlying library go-playground/webhooks skips verification, allowing unauthenticated attackers with network access to the burrito-server to submit forged webhook payloads.

Impact

An attacker can create or delete TerraformPullRequest custom resources by injecting forged events. By pairing a valid pull request number with a controlled branch, an attacker can force the operator to execute a terraform plan using its stored Git and cloud credentials. While the vulnerability does not directly trigger a terraform apply, it facilitates unauthorized exposure of infrastructure changes and potential code execution during the plan phase if the attacker-controlled branch contains malicious provider or data-source configurations.

Recommendation

  • Upgrade Burrito to version 0.13.0 or later immediately.
  • Audit all TerraformRepository configurations in your Kubernetes environment to ensure the webhookSecret field is configured and non-empty.
  • Restrict network access to the burrito-server endpoint to only allow incoming traffic from legitimate GitHub or GitLab IP ranges.

Immediate actions

Upgrade Burrito to version 0.13.0 or later

IT Operations 24h

Threat Hunt

Identify TerraformRepository resources with missing or empty WebhookSecret

T1190 high high confidence hunt now

Data: Kubernetes resource configurations (TerraformRepository custom resources)

Mitigations

Configure non-empty WebhookSecret for all TerraformRepository objects

immediate IT Operations

CVE-2026-102649