6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39961

CVE-2026-39961: Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and writes the password into a new secret in the attacker's namespace. The operator acts as a confused deputy: its ServiceAccount has cluster-wide secret read/write (aiven-operator-role ClusterRole), and it trusts user-supplied namespace values in spec.connInfoSecretSource.namespace without validation. No admission webhook enforces this boundary — the ServiceUser webhook returns nil, and no ClickhouseUser webhook exists. This vulnerability is fixed in 0.37.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39961

CVE-2026-39961:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/aiven/aiven-operator	go	>= 0.31.0, < 0.37.0	0.37.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a 'confused deputy' issue within the Aiven Operator. The operator's service account has cluster-wide permissions to read and write secrets. The ClickhouseUser and ServiceUser custom resources allowed users to specify a connInfoSecretSource which included a namespace field. The operator's controllers did not validate this namespace, trusting the user-supplied value.

This allowed an attacker with permissions to create ClickhouseUser or ServiceUser resources in one namespace to craft a resource that points to a secret in a different, potentially privileged, namespace. The operator would then use its elevated permissions to read this secret and, as described in the advisory, write the contents into a new secret in the attacker's namespace, thereby exfiltrating the data.

The primary vulnerable function is GetPasswordFromSecret in controllers/secret_password_manager.go, which was responsible for reading the secret from the user-specified namespace. A related vulnerable function, connInfoSecretRefIndexFunc, was used to set up watches on these secrets, also incorrectly using the user-provided namespace.

The patch remediates this vulnerability by removing the namespace field from the ConnInfoSecretSource API definition entirely, and modifying the controller logic to always use the namespace of the custom resource itself when accessing secrets, thus enforcing that secrets can only be accessed from within the same namespace.

Vulnerable functions

GetPasswordFromSecret

controllers/secret_password_manager.go

This function fetches a password from a Kubernetes secret. The vulnerability lies in the fact that it used to honor the `namespace` field within the `connInfoSecretSource` part of a `ClickhouseUser` or `ServiceUser` custom resource. This allowed an attacker to specify a secret in any namespace, and the operator, acting as a confused deputy with cluster-wide secret access, would fetch it. The patch removes this by always using the namespace of the custom resource itself.

connInfoSecretRefIndexFunc

controllers/secret_watch_controller.go

This function is used by the operator's secret watcher to determine which custom resources are affected by a change in a secret. It was vulnerable because it constructed the secret's key for its index using the user-provided namespace from `connInfoSecretSource`. This allowed an attacker to make the operator watch secrets in arbitrary namespaces. The fix ensures that the watcher only considers secrets in the same namespace as the custom resource.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.