{"schema":"threatline.record/2","record":{"id":"CVE-2026-108728","aliases":[],"summary":"Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook","details":"Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.","categories":["Unclassified"],"product":"flyte","vendor":"flyteorg","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108728","source_modified_at":"2026-10-18T11:53:06.664Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"flyte","vendor":"flyteorg","versions":[{"version":"2.0.1","lessThanOrEqual":"2.0.51","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00232,"percentile":0.13255,"score_date":"2026-10-23"},"published_at":"2026-10-11T12:19:36.569Z","modified_at":"2026-10-18T11:53:06.664Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108728","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-18T11:53:06.664Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108728","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind/flyte-file-secret-pod-spec-disclosure-20261010","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/flyteplugins/go/tasks/pluginmachinery/secret/embedded_secret_manager.go#L389-L394","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/flyteplugins/go/tasks/pluginmachinery/secret/embedded_secret_manager.go#L531-L546","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/executor/pkg/webhook/handler.go#L168-L189","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/flyteorg/flyte","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/flyte-2.0.1-through-2.0.51-cleartext-secret-exposure-via-admission-webhook","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-18T11:31:35.120419Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-18T11:53:06.664Z","content_hash":"8fc794b620a7bc0152860fe20704f3e95e9634e53bef87901678c058e45b1bff"}}