Cleartext secret exposure in Flyte via admission webhook
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
Flyte from 2.0.1 through 2.0.51 stores sensitive data in cleartext. The embedded secret manager webhook writes base64-encoded values of FILE-mounted secrets into the SECRETS environment variable of init containers (CWE-312). A user with low privileges who can read Pods can decode these values from the Pod spec, even without access to the secret store.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for flyte.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108728
- 2026-10-11 Alias added: GHSA-9m8h-33m4-p9vv
- 2026-10-12 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 4
- https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/flyteplugins/go/tasks/pluginmachinery/secret/embedded_secret_manager.go#L389-L394
- https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/flyteplugins/go/tasks/pluginmachinery/secret/embedded_secret_manager.go#L531-L546
- https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/executor/pkg/webhook/handler.go#L168-L189
- https://github.com/flyteorg/flyte
More flyteorg vulnerabilities
- TI-2022-08667 Server-Side Request Forgery in FlyteConsole CVSS 3.1CRITICAL 9.1
- TI-2023-22283 FlyteAdmin SQL Injection in List Filters CVSS 3.1HIGH 8.8
- TI-2022-18649 Default OAuth Authorization Server secret in FlyteAdmin CVSS 3.1HIGH 7.5
- TI-2022-13188 Insufficient AccessToken Expiration Check in FlyteAdmin CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-108728 · CVE Program
- CVE-2026-108728 · NVD
- FIRST EPSS
- GHSA-9m8h-33m4-p9vv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108728 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences