Flyte: FILE-mounted secrets land in pod spec env vars, readable by anyone with pod read

Impact

Flyte schedules ML training and batch workloads onto GPU nodes, and its embedded secret manager webhook mutates task pods to deliver secrets. For FILE-mounted secrets it base64-encodes the value into a SECRETS environment variable on an init container, which means the secret body lives in the pod spec rather than only in a mounted volume. Any principal with get/list on pods in that namespace - a far more commonly granted permission than read on Secrets - can decode the plaintext from the spec. On a shared cluster this collapses the separation between "can see what workloads are running" and "can read the credentials those workloads use": object-store keys, registry credentials and model-repository tokens belonging to other teams.

Who can reach it

Any authenticated principal with pod read access in the namespace where Flyte task pods run, including service accounts belonging to other tenants' workloads if RBAC grants pod listing. No access to the Kubernetes Secret store itself is needed.

What to do

Affects Flyte 2.0.1 through 2.0.51; the record names no fixed release. Until one lands, tighten RBAC so pod get/list is not granted broadly in Flyte's execution namespaces, avoid FILE-mounted secrets through the embedded secret manager (use an external secrets backend or volume-only delivery), and rotate any secret that was delivered this way. Remediation is control-plane configuration plus a Flyte propeller/webhook restart; GPU nodes do not need draining.

References

Related entries

• Grafana: Auth Proxy cache key collision authenticates a low-privileged user as an administratorCVE-2026-14199 · Grafana Auth Proxy authentication (identity cache key built by concatenation)High
• GitLab EE: missing authorization lets a low-privileged member change restricted project settingsCVE-2026-16494 · GitLab EE (project update endpoint authorization)High
• Grafana: alert rule marked as a server-side expression bypasses datasource query authorizationCVE-2026-17183 · Grafana (alert rule server-side expression datasource authorization)High
• GitLab: unauthenticated GraphQL mutations executed via GET through multiplex query handlingCVE-2026-19650 · GitLab CE/EE (GraphQL multiplex query handling)High
• External Secrets Operator: webhook generator skips the required type label checkCVE-2026-26287 · External Secrets Operator (webhook generator EnforceLabels)High
• MinIO (server-side encryption / replication): An authenticated tenant can inject SSE metadata through replicationCVE-2026-34204 · MinIO (server-side encryption / replication)High