Burrito operator: unsigned webhooks let anyone forge PR events and run terraform plan with stored credentials

Impact

When a TerraformRepository credential omits webhookSecret or sets it empty, go-playground/webhooks skips signature verification and burrito-server accepts forged GitHub and GitLab events. Anyone who can reach the endpoint and knows a tracked repository URL can create or delete TerraformPullRequest custom resources with chosen Branch, Base and ID. For GitHub pull_request events the controller fetches changed files by the real PR number without cross-checking the payload's branch, so pairing a real PR number with an unrelated branch triggers an unauthorized terraform plan using the operator's stored git and cloud credentials, and code analysis indicates the plan can be posted into the real PR's comment thread - leaking and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this alone cannot force a terraform apply; plan-time provider and data-source code execution depends on what the selected branch contains. For an operator this is the Terraform controller that provisions the fleet, so the credentials in play are usually cloud-admin grade.

Who can reach it

Any attacker with network reach to burrito-server's /api/webhook who knows a tracked repository's URL. Unauthenticated when the credential has no webhookSecret - including credentials configured only for git auth or polling.

What to do

Upgrade to 0.13.0 and roll out burrito-server. Independently, set a non-empty webhookSecret on every TerraformRepository credential, including polling-only ones, and keep the webhook endpoint off the public internet. Controller pod restart - no node maintenance. Review PR comment threads for plans posted from branches that do not belong to them.

References

Related entries

• StreamsHub Console operator: tenant-supplied container image runs with a cluster-wide Strimzi ServiceAccountCVE-2026-105312 · StreamsHub Console for Apache Kafka (Console CR operator, image field)Critical
• Argo CD repo-server: Jsonnet imports escape the repository root and read service-account tokensCVE-2026-113672 · Argo CD argocd-repo-server (Jsonnet import path confinement)Critical
• Argo CD repo-server: Kustomize ref value injects git --upload-pack and runs commands in the podCVE-2026-113708 · Argo CD argocd-repo-server (Kustomize remote ref passed to git fetch)Critical
• Argo CD repo-server: repository-controlled Helm configHome auto-loads a downloader plugin and executes itCVE-2026-113709 · Argo CD argocd-repo-server (Kustomize helmGlobals.configHome plugin loading)Critical
• Beta9 worker: tenant image build steps run with chroot isolation only and escape to the privileged worker podCVE-2026-120306 · Beta9 worker (Buildah image build steps, BUILDAH_ISOLATION=chroot)Critical
• Beta9 worker: sandbox file API path traversal gives a tenant root read/write across the whole workerCVE-2026-120307 · Beta9 worker (sandbox file API, getHostPathFromContainerPath)Critical