CVE-2026-102649

The Burrito Kubernetes operator (Terraform Automation Collaboration Software) is vulnerable to unauthorized actions prior to version 0.13.0 . When a TerraformRepository omits or leaves the webhookSecret empty, the POST /api/webhook endpoint accepts unsigned GitHub and GitLab events. An attacker w...