A critical authentication bypass in the Yoke Air Traffic Controller component allows unauthenticated network actors to trigger unauthorized WASM module execution, posing a significant risk to cluster integrity.

This vulnerability is caused by missing authentication checks in the Air Traffic Controller webhook endpoints. An unauthenticated attacker located within the cluster network can bypass Kubernetes API Server authentication to send malicious AdmissionReview requests.

The ability to trigger WASM module execution within the controller context grants an attacker the power to manipulate infrastructure deployments and potentially escalate privileges. Given the CVSS score of 7.5, this high-severity flaw threatens the confidentiality and integrity of the entire infrastructure-as-code pipeline, risking unauthorized resource modification and service disruption.

Immediate Action: As no patch is currently available, administrators should restrict network access to the Air Traffic Controller webhook endpoints using Kubernetes NetworkPolicies to prevent unauthorized pod communication.

Proactive Monitoring: Monitor cluster ingress and egress logs for unexpected AdmissionReview requests or unusual activity originating from internal pods targeting the ATC component.

Compensating Controls: Implement strict mTLS requirements for all internal service-to-service communication to ensure that only authorized components can interact with the ATC webhook.

Public Exploit Available: Unknown.

This vulnerability represents a significant security gap in the deployment pipeline. Organizations should prioritize isolating the affected Yoke components within their network architecture and monitor for vendor updates closely to ensure the flaw is remediated as soon as a fix is released.