padok-team CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL padok-team CVE published 2026-10-26

CVE-2026-102649

Burrito, a Terraform Automation Collaboration Software (TACoS) Kubernetes operator, is vulnerable to unauthenticated webhooks triggering unauthorized Terraform plans when webhookSecret is unset. This vulnerability, CVE-2026-102649, affects Burrito installations prior to version 0.13.0. The issue allows attackers to create or delete TerraformPullRequest custom resources with attacker-chosen fields, potenti [truncated]