Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
Date: 2026-02
Affected: go/github.com/yokecd/yoke
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-26056
CWE: CWE-94
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

# Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC This vulnerability exists in the Air Traffic Controller (ATC) component of Yoke, a Kubernetes deployment tool. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a malicious URL through the `overrides.yoke.cd/flight` annotation. The ATC controller downloads and executes the WASM module without proper URL validation, enabling attackers to create arbitrary Kubernetes resources or potentially escalate privileges to cluster-admin level. **Recommended CWE**: CWE-94 (Improper Control of Generation of Code - Code Injection) ## Summary Yoke ATC allows users to override the Flight WASM module URL via the `overrides.yoke.cd/flight` annotation on Custom Resources. The controller only checks if the user has `update` permission on `airways` resources but does not validate the WASM URL source. An attacker with CR create/update permissions can inject a malicious WASM URL, causing the ATC controller to download and execute arbitrary code. ## Details The vulnerability exists in two code paths: **Source Point - Annotation Definition** (`pkg/flight/flight.go:41-42`): ```go const ( AnnotationOverrideFlight = "overrides.yoke.cd/flight" AnnotationOverrideMode = "overrides.yoke.cd/mode" ) ``` **Sink Point 1 - Admission Webhook** (`cmd/atc/handler.go:298-300`): ```go if overrideURL, _, _ := unstructured.NestedString(cr.Object, "


Mitigations:

Architectural layers (MAESTRO):