What’s Vulnerable › Vulnerabilities

CVE-2026-102649: Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset

Description

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.

Summary

Burrito, a Kubernetes operator for Terraform automation, before 0.13.0 accepts unsigned GitHub and GitLab webhook events when a TerraformRepository credential omits webhookSecret or leaves it empty, because the webhook library skips verification for empty secrets. Anyone who can reach burrito-server and knows a tracked repository URL can forge events that create or delete TerraformPullRequest resources, and by pairing a real pull request number with an unrelated branch they can trigger unauthorized terraform plan runs using the operator's stored git and cloud credentials, potentially posting results to the real pull request's comments. Auto-apply is disabled for these temporary layers, so apply cannot be forced by this flaw alone, but plan-time code execution depends on the selected branch's contents. No exploitation is reported and it is not in CISA KEV. Upgrade to 0.13.0; until then, set a non-empty webhookSecret on all credentials and restrict network access to the burrito-server webhook endpoint.

يقبل Burrito، وهو مشغّل Kubernetes لأتمتة Terraform، قبل الإصدار 0.13.0 أحداث webhook غير موقّعة من GitHub وGitLab عندما تكون قيمة webhookSecret في بيانات اعتماد TerraformRepository غائبة أو فارغة، لأن مكتبة webhook تتخطى التحقق عندما يكون السر فارغاً. يمكن لأي شخص يصل إلى burrito-server ويعرف رابط مستودع متتبَّع أن يزوّر أحداثاً تنشئ أو تحذف موارد TerraformPullRequest، وعبر اقتران رقم pull request حقيقي بفرع غير ذي صلة يمكنه إطلاق عمليات terraform plan غير مصرّح بها باستخدام بيانات اعتماد git والسحابة المخزنة لدى المشغّل، مع احتمال نشر النتائج في تعليقات pull request الحقيقي. التطبيق التلقائي معطّل لهذه الطبقات المؤقتة، لذا لا يمكن فرض terraform apply بهذا العيب وحده، لكن تنفيذ الشيفرة أثناء التخطيط يعتمد على محتوى الفرع المختار. لا توجد تقارير عن استغلال فعلي وهو غير مدرج في CISA KEV. رقّوا إلى الإصدار 0.13.0، وإلى حين ذلك عيّنوا webhookSecret غير فارغ لكل بيانات الاعتماد وقيّدوا الوصول الشبكي إلى نقطة webhook في burrito-server.

Affected products

References

Get alerted when CVE-2026-102649 or the next vulnerability affects your stack