Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send AdmissionReview requests to the webhook, bypassing Kubernetes API Server authentication. This enables attackers to trigger WASM module execution in the ATC controller context without proper authorization.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26055 Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of … https://www.cve.org/CVERecord?id=CVE-2026-26055
Post summary
The text announces CVE‑2026‑26055 affecting Yoke’s Air Traffic Controller component in versions 0.19.0 and earlier, without providing a PoC, exploit, or patch information.
CVE-2026-26055: Flying Blind: Yoke ATC's Open Door Policy (CVE-2026-26055) A critical authentication bypass in Yoke's Air Traffic Controller (ATC) component allows unauthenticated network actors to trigger WebAssembly admission logic directly. By fail... https://cvereports.com/reports/CVE-2026-26055
Post summary
The text announces a critical authentication bypass in Yoke’s ATC component that allows unauthenticated actors to trigger WebAssembly admission logic, but it does not mention a PoC, exploit, patch, or active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | yokecd | yoke | - | - | - |