Cleartext Secret Storage Vulnerability in Flyte by FlyteOrg
CVE-2026-108728

7.1HIGH

Key Information:

Vendor

Flyteorg

Status
Flyte
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108728?

Flyte versions 2.0.1 through 2.0.51 expose sensitive information due to a vulnerability in their cleartext secret storage mechanism. This flaw allows users with Pod read access to exploit init container environment variables, thereby retrieving secrets that should remain confidential. The embedded secret manager webhook encodes these secret values in base64 and places them into the SECRETS environment variable, which can be read even by users lacking direct access to the secret store, leading to potential sensitive data leakage.

Affected Version(s)

flyte 2.0.1 <= 2.0.51

References

https://hackmd.io/@haind/flyte-file-secret-pod-spec-discl...
third-party-advisory
https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8...
technical-description
https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.