GO-2026-4493
NoneCVSS
—
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC in github.com/yokecd/yoke
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/yokecd/yoke | 0 | No fix |
Related vulnerabilities
- CVE-2026-26056 Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. Same vulnerability
- GO-2026-4491 Unauthenticated Admission Webhook Endpoints in Yoke ATC in github.com/yokecd/yoke Also affects github.com/yokecd/yoke
- CVE-2026-26055 Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. Also affects github.com/yokecd/yoke