burrito vulnerabilities

CVEs whose affected-version data names the burrito package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-102649Critical· 9.9

2d ago

Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset

Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set i…

▾ Midnightpadok-team · burritoEPSS 0.46%via CVEORG