CVE-2026-108728
Description
A flaw was found in Flyte. This flaw allows information disclosure when the embedded secret manager webhook writes file-mounted secrets into init container environment variables. An authenticated user with read access to Pod specifications can view and decode these values to obtain sensitive secrets without having direct access to the secret store.
Statement
This vulnerability is rated as having a Moderate impact because an attacker must already possess valid credentials with authorization to inspect Pod objects within the cluster. Although this exposure permits unauthorized retrieval of file-mounted secret data from initialization container configurations, it does not allow modification of cluster resources or remote code execution. Furthermore, Flyte is not shipped or supported as a standard component within Red Hat enterprise products.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
An attacker with access to the system could read sensitive information stored in cleartext (i.e., unencrypted). Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
