An authenticated code injection vulnerability in the Yoke Air Traffic Controller (ATC) component enables attackers to achieve remote code execution and potential cluster-admin privilege escalation.

The vulnerability exists due to improper validation of URLs within the overrides.yoke.cd/flight annotation. An attacker with Kubernetes resource creation or update permissions can force the ATC controller to download and execute arbitrary WASM modules in the controller context.

The ability to execute arbitrary code within the Air Traffic Controller context poses a severe risk to the entire Kubernetes cluster. With a CVSS score of 8.8, this flaw could allow an attacker to gain cluster-admin privileges, resulting in full data compromise, unauthorized resource manipulation, and a total loss of infrastructure integrity.

Immediate Action: As no fixed version is currently available, users should restrict access to CR create or update permissions for the Yoke controller to only highly trusted service accounts. Monitor the official GitHub advisory for the release of a patched version and apply it immediately upon availability.

Proactive Monitoring: Review Kubernetes audit logs for suspicious activity involving the overrides.yoke.cd/flight annotation and monitor the ATC controller for unexpected network egress or WASM execution patterns.

Compensating Controls: Implement Admission Controllers to validate or block the use of the overrides.yoke.cd/flight annotation for all non-privileged users within the cluster.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for full cluster compromise, organizations utilizing Yoke must treat this vulnerability with high priority. Even in the absence of a direct software patch, security teams must proactively restrict the permissions required to trigger the injection and implement strict monitoring of the ATC component to mitigate the risk of exploitation.