Approved changes feed: RSS · Atom
cpe:2.3:a:yokecd:yoke:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Yokecd (44024a8d-ca91-5188-a621-b5d95012b799) |
|---|---|
| Product | Yoke (891d1d7d-eee0-51c7-b46d-57007193ad69) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/yokecd/yoke |
purl2cpe | 2026-07-28 16:41:17.037691 |
pkg:golang/github.com/yokecd/yoke |
purl2cpe | 2026-07-28 16:41:17.037692 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26056 |
vulnerable | 2026-06-08 07:53:20.758715 |
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
HIGH (8.8)
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the overrides.yoke.cd/flight annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.
Published: 2026-02-12T21:11:13.408Z
Updated: 2026-02-12T21:33:22.829Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26055 |
vulnerable | 2026-06-08 07:53:20.758267 |
Unauthenticated Admission Webhook Endpoints in Yoke ATC
HIGH (7.5)
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.
Published: 2026-02-12T21:07:17.914Z
Updated: 2026-02-12T21:36:37.816Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.