CVE-2026-108728
HIGH
7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.
312
Cleartext Storage of Sensitive Information
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT, Mobile
https://github.com/flyteorg/flyte
https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179…
https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179…
https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179…
https://hackmd.io/@haind/flyte-file-secret-pod-spec-disclosure-20261010
https://www.vulncheck.com/advisories/flyte-2.0.1-through-2.0.51-cleartext-secre…