{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/burrito--0.13.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:burrito:burrito:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-102649"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-102649\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Burrito (\u003c 0.13.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Burrito"],"content_html":"\u003cp\u003eBurrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Versions prior to 0.13.0 contain a vulnerability (CVE-2026-102649) where the \u003ccode\u003ePOST /api/webhook\u003c/code\u003e endpoint fails to authenticate GitHub and GitLab events if a \u003ccode\u003eTerraformRepository\u003c/code\u003e has no \u003ccode\u003ewebhookSecret\u003c/code\u003e defined. Because the secret is optional, the underlying library \u003ccode\u003ego-playground/webhooks\u003c/code\u003e skips verification, allowing unauthenticated attackers with network access to the \u003ccode\u003eburrito-server\u003c/code\u003e to submit forged webhook payloads.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can create or delete \u003ccode\u003eTerraformPullRequest\u003c/code\u003e custom resources by injecting forged events. By pairing a valid pull request number with a controlled branch, an attacker can force the operator to execute a \u003ccode\u003eterraform plan\u003c/code\u003e using its stored Git and cloud credentials. While the vulnerability does not directly trigger a \u003ccode\u003eterraform apply\u003c/code\u003e, it facilitates unauthorized exposure of infrastructure changes and potential code execution during the plan phase if the attacker-controlled branch contains malicious provider or data-source configurations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Burrito to version 0.13.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit all \u003ccode\u003eTerraformRepository\u003c/code\u003e configurations in your Kubernetes environment to ensure the \u003ccode\u003ewebhookSecret\u003c/code\u003e field is configured and non-empty.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the \u003ccode\u003eburrito-server\u003c/code\u003e endpoint to only allow incoming traffic from legitimate GitHub or GitLab IP ranges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T21:05:58Z","date_published":"2026-10-26T19:44:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-burrito-auth-bypass/","summary":"Burrito Kubernetes operator prior to 0.13.0 fails to verify webhook signatures when the secret is empty, allowing attackers to forge repository events and trigger unauthorized terraform plan operations.","title":"Burrito: Authentication bypass in webhook processing (CVE-2026-102649)","url":"https://feed.craftedsignal.io/briefs/2026-10-burrito-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Burrito (\u003c 0.13.0)","version":"https://jsonfeed.org/version/1.1"}