CVE-2026-102649 padok-team CVE debrief

Who should care

Defenders responsible for Burrito installations, especially those using Terraform Automation Collaboration Software (TACoS) Kubernetes operator versions prior to 0.13.0, should assess exposure and verify webhook configurations.

Why it matters

CVE-2026-102649 allows attackers to trigger unauthorized Terraform plans in Burrito installations prior to version 0.13.0, potentially leading to security risks. Defenders should verify exposure, assess webhook configurations, and restrict access to the burrito-server endpoint.

• Verify webhook configurations to prevent unauthorized Terraform plans.
• Restrict access to the burrito-server endpoint to only trusted sources.
• Monitor for suspicious Terraform plan activity.

Technical summary

Burrito, a Terraform Automation Collaboration Software (TACoS) Kubernetes operator, is vulnerable to unauthenticated webhooks triggering unauthorized Terraform plans when webhookSecret is unset. This can allow attackers to create or delete TerraformPullRequest custom resources with attacker-chosen fields, potentially leading to unauthorized terraform plan for affected layers. The vulnerability affects Burrito installations prior to version 0.13.0 and can be mitigated by verifying webhook configurations, restricting access to the burrito-server endpoint, and monitoring for suspicious activity. The issue is caused by the go-playground/webhooks library skipping signature or token verification when the secret is

Defensive priority

Defenders should prioritize verifying exposure of Burrito installations, especially those using Terraform Automation Collaboration Software (TACoS) Kubernetes operator versions prior to 0.13.0, and assess the security of their webhook configurations.

Recommended defensive actions

• Verify Burrito installation versions and ensure webhookSecret is set for all Terraform repositories.
• Restrict access to the burrito-server endpoint to only trusted sources.
• Monitor for suspicious Terraform plan activity and review webhook configurations.
• Update Burrito to version 0.13.0 or later.
• Perform a thorough review of webhook configurations to prevent unauthorized Terraform plans.
• Implement additional monitoring to detect potential security incidents.
• Conduct a security audit to identify potential vulnerabilities in the Burrito installation.

Evidence notes

The CVE record and source item provide details on the vulnerability in Burrito, a Terraform Automation Collaboration Software (TACoS) Kubernetes operator, where unauthenticated webhooks can trigger unauthorized Terraform plans when webhookSecret is unset. The source item is from the CVE Program cvelistV5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.