-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/labring/sealos | go | <= 4.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access control around Payment resources (sealos.io/v1/Payment). In Kubernetes operator patterns: 1) Controller reconciliation loops (Reconcile) require explicit RBAC checks which appear missing here 2) API handlers (createPayment) should validate user ownership of namespaces. The combination allows users to create/modify Payment resources in controlled namespaces without proper financial validation. The high confidence comes from the direct mapping between described attack vectors (namespace control + payment manipulation) and standard Kubernetes controller/auth patterns.