Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource
Vulnerability Description
Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and writes the password into a new secret in the attacker's namespace. The operator acts as a confused deputy: its ServiceAccount has cluster-wide secret read/write (aiven-operator-role ClusterRole), and it trusts user-supplied namespace values in spec.connInfoSecretSource.namespace without validation. No admission webhook enforces this boundary — the ServiceUser webhook returns nil, and no ClickhouseUser webhook exists. This vulnerability is fixed in 0.37.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
特权管理不恰当
Vulnerability Title
Aiven Operator 安全漏洞
Vulnerability Description
Aiven Operator是Aiven开源的一个Kubernetes集群管理云服务的操作器。 Aiven Operator 0.31.0至0.37.0之前版本存在安全漏洞，该漏洞源于操作员信任用户提供的命名空间值而未经验证，可能导致具有创建权限的开发人员从任何其他命名空间泄露密钥。
CVSS Information
N/A
Vulnerability Type
N/A