Critical Container Vulnerability CVE-2026-111497 Exploited via Public AWS EKS Cluster with Sensitive Data Access
A critical vulnerability, CVE-2026-111497 (Broccoli2Shell), affecting the Brotli decoder in Node.js used by an internet-facing container in an AWS EKS Kubernetes cluster has been identified. The container runs a vulnerable image exposing an unauthenticated public endpoint with no perimeter defenses, allowing potential remote code execution. Coupled with insecure Kubernetes practices (service account token automount) and an overprivileged IAM role granting access to sensitive cloud storage buckets containing PII and credit card data, this creates a multi-layer attack chain from initial code execution to data breach. The Wiz Green Agent tool rapidly mapped the full attack path and identified multiple remediation levers including immediate zero-downtime cloud mitigations (disabling automount tokens, restricting IAM policies, masking data) and permanent fixes (patching container images and infrastructure as code). It also mapped owners in version control to facilitate coordinated response while preserving production uptime. This incident demonstrates the complexity of modern cloud threats requiring integrated runtime and cloud context for effective prioritized remediation, balancing speed with business continuity demands.
Linha do tempo
-
Critical Container Vulnerability CVE-2026-111497 Exploited via Public AWS EKS Cluster with Sensitive Data Access
ler a análise desta fonte ocultar
A critical vulnerability, CVE-2026-111497 (Broccoli2Shell), affecting the Brotli decoder in Node.js used by an internet-facing container in an AWS EKS Kubernetes cluster has been identified. The container runs a vulnerable image exposing an unauthenticated public endpoint with no perimeter defenses, allowing potential remote code execution. Coupled with insecure Kubernetes practices (service account token automount) and an overprivileged IAM role granting access to sensitive cloud storage buckets containing PII and credit card data, this creates a multi-layer attack chain from initial code execution to data breach. The Wiz Green Agent tool rapidly mapped the full attack path and identified multiple remediation levers including immediate zero-downtime cloud mitigations (disabling automount tokens, restricting IAM policies, masking data) and permanent fixes (patching container images and infrastructure as code). It also mapped owners in version control to facilitate coordinated response while preserving production uptime. This incident demonstrates the complexity of modern cloud threats requiring integrated runtime and cloud context for effective prioritized remediation, balancing speed with business continuity demands.