Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kiwicom/k8s-vault-operator

              main @ 69834d4
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Cross-tenant Information Disclosure: 1 prior fix. Scrutinize any change in this area.

controllers/vaultsecret_controller.go: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-tenant Information Disclosure: A non-injective cache key allowed one tenant's AuthServiceAccount to be returned to another, potentially leaking Vault secrets. The fix introduced a SHA-256 hash of length-prefixed fields, but any future cache key change risks reintroducing collisions.

SSRF: Per-resource Vault addresses were not validated, allowing the controller to connect to arbitrary hosts and potentially access internal services. The fix added an allowlist check, but any new path that dials a Vault address must enforce the same validation.