What is CVE-2026-102649 in the Burrito Kubernetes operator?

CVE-2026-102649 is a critical vulnerability affecting the Burrito Terraform Automation Collaboration Software (TACoS) operator for Kubernetes prior to version 0.13.0, carrying a CVSS score of 9.9. The security flaw stems from how `POST /api/webhook` accepts unsigned GitHub and GitLab events when a repository's credentials omit the `webhookSecret` or leave it empty, as detailed in the official advisory GHSA-7m68-72r6-3jx8.

Because `Credential.WebhookSecret` is optional, the underlying `go-playground/webhooks` library completely skips signature or token verification when the secret field is left blank. Similarly to other critical infrastructure flaws such as RCE en OpenHands Software Agent SDK, unauthenticated entry points expose administrative or automation workflows to severe external manipulation.

Who is affected and how does the attack work?

Anyone who can successfully reach the `burrito-server` endpoint and knows the URL of a tracked repository can exploit this vulnerability. The attacker can forge events to create or delete `TerraformPullRequest` custom resources specifying arbitrary branch, base, and ID fields.

For GitHub pull request events, the controller fetches changed files using the real pull request number but fails to cross-check the payload's branch against that request. This flaw can be compared in severity to other high-impact supply chain risks like vulnerabilidad crítica en la librería zip de Rust, where improper validation leads directly to system compromise.

How do I protect my cluster against this vulnerability?

Mitigating this vulnerability requires updating the operator and enforcing strict token validation across all tracked repositories. Administrators must ensure that no credentials leave the webhook secret field empty.

Follow these specific steps to secure your deployment against unauthorized webhook forging:

  1. Upgrade the Burrito Kubernetes operator to version 0.13.0 or later using the official release.
  2. Review all `TerraformRepository` custom resources and ensure that every credential configuration defines a robust `webhookSecret`.
  3. Verify the remediation by inspecting the git commit patch to confirm that empty webhook secrets are no longer accepted without validation.