Vulnerability in Burrito Terraform Automation Collaboration Software by Padok

CVE-2026-102649

What is CVE-2026-102649?

The Burrito Terraform Automation Collaboration Software (TACoS) has a vulnerability that allows unauthenticated access to webhook events. Prior to version 0.13.0, the POST /api/webhook endpoint accepts GitHub and GitLab events without validating signatures when the webhookSecret is not provided or is blank. This creates a risk where an adversary could forge webhook events that impact TerraformPullRequest resources. Notably, the controller mismanages pull request validation by not verifying the branch linked to real pull request numbers, enabling unauthorized terraform plan executions with unintended consequences. Although the terraform apply execution isn't automatically triggered, this flaw raises severe concerns about accidental exposure of sensitive infrastructure changes. The issue has been resolved in version 0.13.0.

References