Zero Radar
← feed
CriticalVulnerabilityCVE-2026-102649updated 26 Oct 2026, 18:22 UTC

Burrito Terraform operator accepts forged webhook events when no secret is set

If a repository's webhook secret is left blank, anyone who can reach the server can fake GitHub or GitLab events. Those fake events can make the server run infrastructure plans using its stored credentials.

Fixed in Burrito 0.13.0Official source
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesBurrito 0.13.0 · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerKnows a tracked repository URL
  2. 2Forged webhookUnsigned GitHub or GitLab event sent
  3. 3burrito-serverAccepts event, no secret to verify
  4. 4Unauthorized planBranch paired with a real PR number
  5. 5Cloud accessPlan runs with stored credentials
  6. ResultPlans run with operator credentials, output posted to PR

What happened

Burrito, a Kubernetes operator for Terraform, skips webhook signature checks on POST /api/webhook when a TerraformRepository's credentials omit webhookSecret or set it empty. Forged events can create or delete TerraformPullRequest resources with attacker-chosen branch and PR fields, and the GitHub pull_request handler does not verify that the branch matches the real pull request.

Why it is dangerous: An unauthenticated attacker who knows a tracked repository URL can trigger terraform plan runs using the operator's cloud and git credentials, and post the resulting plan output to a real pull request's comments, exposing or misattributing another branch's infrastructure changes. Teams running Burrito without a webhook secret are at risk.

Are you affected?

You are affected if you run Burrito before 0.13.0 and any TerraformRepository has credentials without webhookSecret or with an empty webhookSecret, including repositories used only for git polling.

Burrito (Kubernetes TACoS operator) versions prior to 0.13.0.

What to do

  1. Upgrade Burrito to version 0.13.0 or later
  2. Set a non-empty webhookSecret on every TerraformRepository credential, including those used for polling
  3. Restrict network access to the burrito-server webhook endpoint where possible

Timeline

  1. 26 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 18:22 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102649
CVSS
9.9 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 18:17 UTC
On Zero Radar
26 Oct 2026, 18:22 UTC (5 min after disclosure)
Last change
26 Oct 2026, 18:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Burrito Terraform operator accepts forged webhook events when no secret is set · Zero Radar