CVE-2026-26055: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26055 is a Missing Authentication for Critical Function vulnerability (CWE-306) in the Air Traffic Controller (ATC) component of yokecd/yoke, a Kubernetes deployment tool. The ATC webhook endpoints fail to implement any authentication, allowing any pod within the cluster network to send crafted AdmissionReview requests directly to the webhook, bypassing Kubernetes API Server authentication. All versions up to and including v0.19.0 (yokecd-installer/v0.19.0) are affected. The vulnerability was disclosed on February 12, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Yoke Advisory).

The root cause is the complete absence of authentication middleware in the HTTP handler implementation of the ATC webhook service (classified as CWE-306). Vulnerable endpoints in cmd/atc/handler.go — including /validations/{airway}, /validations/resources, /validations/external-resources, /validations/airways.yoke.cd, /validations/flights.yoke.cd, and /crdconvert/{airway} — decode and process incoming AdmissionReview JSON requests without performing TLS client certificate verification or validating that requests originate from the Kubernetes API Server. An attacker with network access to any pod in the cluster can send a crafted HTTP POST request directly to these endpoints, causing the ATC to execute WASM modules in its controller context under cluster-admin privileges. A full proof-of-concept is publicly available in the security advisory (GitHub Advisory).

Successful exploitation allows an attacker with cluster-network access to trigger unauthorized WASM module execution within the ATC controller context, which operates with cluster-admin privileges. Integrity impact is rated High — when chained with a separate annotation injection vulnerability (VUL-001), an attacker can create arbitrary Kubernetes resources across the cluster. Confidentiality impact is Medium, as WASM execution may expose controller context data, and availability impact is Medium due to potential resource exhaustion from repeated unauthenticated requests. The combination of this flaw with other weaknesses could enable full cluster compromise, including data exfiltration and lateral movement (GitHub Advisory, Yoke Advisory).

A proof-of-concept exploit is publicly available within the security advisory itself, demonstrating successful unauthenticated requests to the ATC webhook from an attacker-controlled pod. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.068–0.118%, indicating a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain cluster network access: Compromise or deploy a pod within the target Kubernetes cluster (e.g., via a misconfigured workload or supply chain attack). Network policies must not restrict access to the ATC service — the default configuration does not restrict this.
2. Identify the ATC service endpoint: Resolve the ATC service DNS name within the cluster, typically atc-atc.atc.svc.cluster.local on port 80.
3. Craft a malicious AdmissionReview payload: Construct a JSON payload mimicking a legitimate Kubernetes AdmissionReview request, specifying a target airway resource and arbitrary userInfo (e.g., username: attacker-from-pod, groups: [system:unauthenticated]).
4. Send the unauthenticated request: From the attacker pod, execute:

kubectl exec webhook-attacker -- curl -k -s -X POST \
  http://atc-atc.atc.svc.cluster.local:80/validations/backends.examples.com \
  -H "Content-Type: application/json" \
  -d @/tmp/malicious-review.json

5. Trigger WASM execution: The ATC processes the request without authentication, executes the associated WASM module in its cluster-admin context, and returns an AdmissionReview response — confirming unauthorized code execution.
6. Escalate impact: Chain with annotation injection (VUL-001) to execute arbitrary WASM code, create Kubernetes resources, or exfiltrate data using ATC's cluster-admin privileges (GitHub Advisory).

• Network: Unexpected HTTP POST requests to ATC webhook endpoints (/validations/{airway}, /validations/resources, /validations/external-resources, /validations/airways.yoke.cd, /validations/flights.yoke.cd, /crdconvert/{airway}) originating from non-kube-apiserver sources within the cluster network.
• Logs: ATC service logs (kubectl logs -n atc deployment/atc-atc) showing "msg":"request served" entries with "method":"POST" and paths matching /validations/* from unexpected source IPs or pods; elevated elapsed times (e.g., "elapsed":"435ms") indicating WASM module execution triggered by external requests.
• Logs: userInfo fields in processed AdmissionReview requests containing system:unauthenticated group membership or unexpected usernames not associated with the Kubernetes API Server.
• Kubernetes Resources: Unexpected Kubernetes resources (pods, deployments, secrets, etc.) created by the ATC service account that were not initiated through normal API Server admission flows.
• Process/Runtime: Unusual WASM module execution events in the ATC controller logs not correlated with legitimate Kubernetes resource admission events (GitHub Advisory).

No patched version of yokecd/yoke was available at the time of disclosure (all versions ≤ 0.19.0 are affected); users should monitor the yoke repository for a fix in versions greater than 0.19.0. As an immediate workaround, deploy a Kubernetes NetworkPolicy in the atc namespace to restrict ingress to the ATC service, permitting only the kube-apiserver (from the kube-system namespace with label component: kube-apiserver) to connect. Additional mitigations include deploying a service mesh (Istio or Linkerd) to enforce mutual TLS (mTLS) between services, implementing strict pod security policies to limit pod creation, and reviewing cluster RBAC policies to reduce the blast radius of a cluster-admin compromise (GitHub Advisory, Yoke Advisory).

The vulnerability was reported by researchers @b0b0haha and @lixingquzhi and published by the yoke project maintainer (davidmdm) on February 12, 2026. The advisory was picked up by security aggregators including INCIBE-CERT and Linux Security, and noted on social media platforms such as Bluesky by TheHackerWire. No major vendor statements or significant community debate beyond the advisory itself have been observed (GitHub Advisory).