CVE-2026-108728Published
Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108728 · Microsoft / collected KEV context
cve-program · CVE-2026-108728
- https://hackmd.io/@haind/flyte-file-secret-pod-spec-disclosure-20261010
- https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/flyteplugins/go/tasks/pluginmachinery/secret/embedded_secret_manager.go#L389-L394
- https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/flyteplugins/go/tasks/pluginmachinery/secret/embedded_secret_manager.go#L531-L546
- https://github.com/flyteorg/flyte/blob/5986692d3c31d2f2a8a48593219ae6b73644a179/executor/pkg/webhook/handler.go#L168-L189
- https://github.com/flyteorg/flyte
- https://www.vulncheck.com/advisories/flyte-2.0.1-through-2.0.51-cleartext-secret-exposure-via-admission-webhook
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.