CVE Feed

    Dashboard / CVE / CVE-2026-26055

    CVE-2026-26055

    Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.

    Published:Feb 12, 2026
    Last Modified:Apr 17, 2026
    EPS:Feb 12, 2026
    EPSS Score:0.00089
    CVSS Score:7.5

    Affected Products

    Vendor
    Yokecd
    Product
    Yoke

    Exploits

    https://github.com/yokecd/yoke/security/advisories/GHSA-965m-v4cc-6334

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High