Exfiltration Vulnerability in Aiven Operator for Kubernetes

CVE-2026-39961

What is CVE-2026-39961?

Aiven Operator, which allows provisioning and management of Aiven services from Kubernetes, has a vulnerability that permits users with create permissions on ClickhouseUser Custom Resource Definitions (CRDs) to access and extract sensitive information, such as production database credentials, API keys, and service tokens, from other namespaces. This exploitation occurs due to a lack of validation for user-supplied namespace values and insufficient admission webhook enforcement. The operator can read secrets using its cluster-wide access rights and transfer them to the attacking user's namespace, posing a severe risk to the integrity and confidentiality of sensitive data. The vulnerability was addressed in version 0.37.0.

References