CVE-2026-39961

{
  "id": "CVE-2026-39961",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T18:17:02.053",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and writes the password into a new secret in the attacker's namespace. The operator acts as a confused deputy: its ServiceAccount has cluster-wide secret read/write (aiven-operator-role ClusterRole), and it trusts user-supplied namespace values in spec.connInfoSecretSource.namespace without validation. No admission webhook enforces this boundary — the ServiceUser webhook returns nil, and no ClickhouseUser webhook exists. This vulnerability is fixed in 0.37.0."
    },
    {
      "lang": "es",
      "value": "Aiven Operator le permite aprovisionar y gestionar Servicios de Aiven desde su clúster de Kubernetes. Desde la versión 0.31.0 hasta antes de la 0.37.0, un desarrollador con permiso de creación en CRDs de ClickhouseUser en su propio espacio de nombres puede exfiltrar secretos de cualquier otro espacio de nombres - credenciales de base de datos de producción, claves de API, tokens de servicio - con un solo kubectl apply. El operador lee el secreto de la víctima usando su ClusterRole y escribe la contraseña en un nuevo secreto en el espacio de nombres del atacante. El operador actúa como un confused deputy: su ServiceAccount tiene lectura/escritura de secretos a nivel de clúster (ClusterRole aiven-operator-role), y confía en los valores de espacio de nombres proporcionados por el usuario en spec.connInfoSecretSource.namespace sin validación. Ningún webhook de admisión aplica este límite - el webhook de ServiceUser devuelve nil, y no existe ningún webhook de ClickhouseUser. Esta vulnerabilidad está corregida en la versión 0.37.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "aiven",
          "product": "aiven-operator",
          "versions": [
            {
              "version": "< 0.37.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T14:08:13.060841Z",
          "id": "CVE-2026-39961",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:aiven:aiven_operator:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.31.0",
              "versionEndExcluding": "0.37.0",
              "matchCriteriaId": "C5AF06D3-28FA-443E-9DFC-D2212C1434E6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/aiven/aiven-operator/commit/032c9ba63257fdd2fddfb7f73f71830e371ff182",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/aiven/aiven-operator/releases/tag/v0.37.0",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/aiven/aiven-operator/security/advisories/GHSA-99j8-wv67-4c72",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}