The vulnerability resides in the Air Traffic Controller component of Yoke, a Helm‑inspired infrastructure-as-code package deployer. The ATC webhook endpoints lack authentication, allowing any pod that can reach the cluster network to send AdmissionReview requests directly to the webhook. This bypasses Kubernetes API Server authentication and enables an attacker to trigger the execution of WebAssembly modules within the ATC controller context without authorization, effectively granting the ability to run arbitrary code in the cluster’s management plane.

Yoke version 0.19.0 and earlier are affected. The product, distributed by yokecd, is the Yoke IaC deployer, and the flaw is present in its ATC component that runs within a Kubernetes cluster. All pods with network reach to the ATC webhook are potential launchpads for exploitation, regardless of workload or cluster configuration.

The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1 % suggesting current exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is any pod inside the cluster that can reach the ATC webhook; once the attacker creates or uses such a pod, crafted AdmissionReview requests can trigger malicious WASM execution. This would grant execution of arbitrary code with the privileges of the ATC controller, potentially enabling full cluster compromise.