CVE-2026-26056: Yoke IaC Package Deployer RCE Vulnerability

CVE-2026-26056 Overview

CVE-2026-26056 is a code injection vulnerability affecting the Air Traffic Controller (ATC) component of Yoke, a Helm-inspired infrastructure-as-code (IaC) package deployer. The vulnerability allows users with Custom Resource (CR) create/update permissions to execute arbitrary WebAssembly (WASM) code in the ATC controller context by injecting a malicious URL through the overrides.yoke.cd/flight annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.

Critical Impact

Attackers with limited Kubernetes permissions can achieve privilege escalation to cluster-admin level by exploiting improper URL validation in the Yoke ATC component, enabling arbitrary code execution and unauthorized resource creation.

Affected Products

• Yoke versions 0.19.0 and earlier
• Yoke Air Traffic Controller (ATC) component
• Kubernetes clusters deploying Yoke for infrastructure-as-code management

Discovery Timeline

• 2026-02-12 - CVE CVE-2026-26056 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26056

Vulnerability Analysis

This vulnerability stems from CWE-94 (Improper Control of Generation of Code - Code Injection). The Yoke Air Traffic Controller is designed to manage flight deployments within Kubernetes environments. When processing Custom Resources, the ATC component reads annotations including overrides.yoke.cd/flight, which can specify a URL pointing to a WASM module.

The fundamental security flaw lies in the lack of proper URL validation before the controller fetches and executes the referenced WASM module. An attacker with permissions to create or update Custom Resources can inject a malicious URL pointing to attacker-controlled infrastructure. The ATC controller then downloads and executes the WASM code within its privileged context, inheriting all permissions granted to the controller service account.

Root Cause

The root cause is insufficient input validation on the overrides.yoke.cd/flight annotation value. The ATC controller trusts user-supplied URLs without verifying they point to legitimate, authorized WASM modules. This design flaw creates a direct path for code injection where any user with CR modification privileges can introduce arbitrary executable code into the controller's execution context.

Attack Vector

The attack exploits the network-accessible annotation processing mechanism. An attacker must have Kubernetes permissions to create or modify Custom Resources that the ATC controller monitors. The attack sequence involves:

1. The attacker creates or modifies a Custom Resource with the overrides.yoke.cd/flight annotation containing a URL to a malicious WASM module
2. The ATC controller detects the resource change and reads the annotation
3. Without proper validation, the controller fetches the WASM module from the attacker-controlled URL
4. The malicious WASM code executes within the controller's security context
5. The attacker's code can then create arbitrary Kubernetes resources or leverage the controller's elevated permissions for privilege escalation

The attack is particularly dangerous because the ATC controller typically operates with elevated permissions to manage cluster resources. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-26056

Indicators of Compromise

• Custom Resources containing overrides.yoke.cd/flight annotations with URLs pointing to external, non-trusted domains
• Unexpected network connections from the ATC controller pod to external hosts
• Unusual Kubernetes resource creation events originating from the ATC controller service account
• ATC controller logs showing downloads from URLs outside the organization's trusted artifact repositories

Detection Strategies

• Implement network policy monitoring to detect outbound connections from ATC controller pods to unexpected destinations
• Configure audit logging for Custom Resource modifications, specifically monitoring for changes to overrides.yoke.cd/flight annotations
• Deploy runtime security monitoring to detect anomalous behavior from the ATC controller, including unexpected system calls or resource creation patterns
• Use admission controllers to validate and restrict annotation values on resources managed by Yoke

Monitoring Recommendations

• Enable Kubernetes audit logging with enhanced verbosity for create/update operations on Yoke-managed Custom Resources
• Monitor the ATC controller's network egress for connections to unauthorized external endpoints
• Implement alerting on privilege escalation attempts or unexpected role binding creations by the ATC service account
• Review controller logs regularly for WASM module fetch operations from non-standard URLs

How to Mitigate CVE-2026-26056

Immediate Actions Required

• Upgrade Yoke to a patched version that includes URL validation for WASM module sources
• Implement network policies to restrict the ATC controller's outbound network access to trusted artifact repositories only
• Review and minimize RBAC permissions granted to users who can create or modify Custom Resources monitored by ATC
• Audit existing Custom Resources for any suspicious overrides.yoke.cd/flight annotation values

Patch Information

Refer to the GitHub Security Advisory for official patch information and updated versions that address this vulnerability. Organizations should upgrade to the latest Yoke version that includes proper URL validation for WASM module sources.

Workarounds

• Deploy Kubernetes NetworkPolicies to restrict egress traffic from the ATC controller pod to only trusted internal registries
• Use admission controllers such as OPA Gatekeeper or Kyverno to validate and restrict annotation values on Yoke-managed resources
• Implement a proxy or firewall rule to allowlist only approved WASM module source URLs for the ATC controller
• Temporarily reduce RBAC permissions for users who can create Custom Resources until the patch is applied

# Example NetworkPolicy to restrict ATC controller egress
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-atc-egress
  namespace: yoke-system
spec:
  podSelector:
    matchLabels:
      app: yoke-atc-controller
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: trusted-registry
    ports:
    - protocol: TCP
      port: 443
EOF