Burrito (< 0.13.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/burrito--0.13.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 19:44:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBurrito: Authentication bypass in webhook processing (CVE-2026-102649)https://feed.craftedsignal.io/briefs/2026-10-burrito-auth-bypass/Mon, 26 Oct 2026 19:44:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-burrito-auth-bypass/Burrito Kubernetes operator prior to 0.13.0 fails to verify webhook signatures when the secret is empty, allowing attackers to forge repository events and trigger unauthorized terraform plan operations.Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Versions prior to 0.13.0 contain a vulnerability (CVE-2026-102649) where the POST /api/webhook endpoint fails to authenticate GitHub and GitLab events if a TerraformRepository has no webhookSecret defined. Because the secret is optional, the underlying library go-playground/webhooks skips verification, allowing unauthenticated attackers with network access to the burrito-server to submit forged webhook payloads.

Impact

An attacker can create or delete TerraformPullRequest custom resources by injecting forged events. By pairing a valid pull request number with a controlled branch, an attacker can force the operator to execute a terraform plan using its stored Git and cloud credentials. While the vulnerability does not directly trigger a terraform apply, it facilitates unauthorized exposure of infrastructure changes and potential code execution during the plan phase if the attacker-controlled branch contains malicious provider or data-source configurations.

Recommendation

  • Upgrade Burrito to version 0.13.0 or later immediately.
  • Audit all TerraformRepository configurations in your Kubernetes environment to ensure the webhookSecret field is configured and non-empty.
  • Restrict network access to the burrito-server endpoint to only allow incoming traffic from legitimate GitHub or GitLab IP ranges.
]]>criticaladvisory