CyberRota Analysis
AI-GeneratedThe vulnerability affects Kubernetes deployments using Woodpecker CI/CD engine versions 1.0.0 to 3.16.0, where users with Push permissions can execute pipeline pods under any ServiceAccount, bypassing administrator controls. This flaw allows potential attackers to inherit RBAC permissions from privileged ServiceAccounts, leading to the exfiltration of sensitive secrets and possible cluster takeover. Organizations using affected versions should prioritize immediate updates to version 3.16.0 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.