What is GHSA-99j8-wv67-4c72?

GHSA-99j8-wv67-4c72 is a security advisory published by GitHub Security Advisories with Medium severity. Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Which CVE IDs does GHSA-99j8-wv67-4c72 cover?

GHSA-99j8-wv67-4c72 covers the following CVE IDs: CVE-2026-39961. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-99j8-wv67-4c72?

GHSA-99j8-wv67-4c72 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-99j8-wv67-4c72?

GHSA-99j8-wv67-4c72 affects 1 product, including: go/github.com/aiven/aiven-operator:\u003e= 0.31.0, \u003c 0.37.0.

GHSA-99j8-wv67-4c72MediumCVSS 6.8

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Vendor

GitHub Security Advisories

Published

April 10, 2026

Last Modified

April 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-39961 →

📋 Description

Impact

A developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and writes the password into a new secret in the attacker's namespace.

The operator acts as a confused deputy: its ServiceAccount has cluster-wide secret read/write (aiven-operator-role ClusterRole), and it trusts user-supplied namespace values in spec.connInfoSecretSource.namespace without validation. No admission webhook enforces this boundary — the ServiceUser webhook returns nil, and no ClickhouseUser webhook exists.

Patches

This vulnerability is resolved in version 0.37.0. We recommend all users update as soon as possible.

Credits

Credits to Andrés Cruciani for finding and reporting the bug through our bug bounty program

🎯 Affected products1

go/github.com/aiven/aiven-operator:>= 0.31.0, < 0.37.0