CVE-2026-102649 - Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
CVE ID :CVE-2026-102649 Published : Oct. 26, 2026, 5:09 p.m. | 1 hour, 14 minutes ago Description :Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a...