Vendor
Burrito Kubernetes operator prior to 0.13.0 fails to verify webhook signatures when the secret is empty, allowing attackers to forge repository events and trigger unauthorized terraform plan operations.