Skip to content
OpenAdvisories

Vendor

padok-team

1 known vulnerabilities.

Products

burrito 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.9
    CVE-2026-102649

    Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset

    Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, i…

    padok-team burrito