CVE-2026-102649

Name of the Vulnerable Software and Affected Versions Burrito versions prior to 0.13.0

Description The POST /api/webhook endpoint accepts unsigned GitHub and GitLab events if a TerraformRepository configuration omits the webhookSecret or sets it to an empty value. This occurs because the go-playground/webhooks library skips signature or token verification when the secret is empty. An attacker who can access the burrito-server endpoint and knows a tracked repository URL can forge events to create or delete TerraformPullRequest custom resources by manipulating the Branch, Base, and ID variables. For GitHub pull request events, the controller fails to cross-check the payload branch against the actual pull request number. This allows an unauthorized terraform plan to be executed using stored git and cloud credentials by pairing a valid pull request number with an unrelated branch. Consequently, the resulting plan may be posted to the legitimate pull request's comment thread, exposing infrastructure changes from another branch. While auto-apply is disabled for these layers, code execution during the plan phase depends on the contents of the selected branch.

Recommendations Update to version 0.13.0. Ensure that webhookSecret is configured and not left empty for all TerraformRepository credentials to enable signature verification.