CVE-2026-26056 - Vulnerability Analysis

Overview

Yoke <= 0.19.0 contains a command injection caused by improper validation of URLs in the Air Traffic Controller component, letting users with create/update permissions execute arbitrary WASM code and escalate privileges.

Severity & Score

Impact

Attackers with create/update permissions can execute arbitrary code and potentially escalate to cluster-admin privileges, compromising the Kubernetes cluster.

Mitigation

Update to a version later than 0.19.0.

References

• https://github.com/yokecd/yoke/security/advisories/GHSA-wj8p-jj64-h7ff

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 12, 2026

🟠 CVE-2026-26056 - High (8.8) Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26056/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner