CVE-2022-39273

FlyteAdmin's CVE-2022-39273 describes a vulnerability in the default OAuth2 authorization server configuration. When ExternalAuthorizationServer is not specified, the default clientid hashes and a hardcoded hashed password in Flyte Admin (and propagated to the Propeller configmap in Helm charts) ...

CVE-2023-41891

FlyteAdmin’s list endpoints are vulnerable to SQL injection in versions prior to 1.1.124, where a malicious user can send REST requests with custom SQL statements as list filters. The attacker must have access to the FlyteAdmin installation (typically behind VPN or authenticated access). A patch ...

CVE-2022-31145

Summary: CVE-2022-31145 concerns FlyteAdmin's validation of access/tokens. In versions up to 1.1.30, authenticated users with external identity providers can continue to use Access Tokens and ID Tokens after expiry. The issue does not affect users configuring FlyteAdmin as the OAuth2 Authorizatio...