Kubernetes Flaws in Aiven Operator and Tekton Resolver Expose Cluster Secrets

Two newly disclosed Kubernetes vulnerabilities show how limited access can escalate into broad secret theft and potential full-cluster compromise. CVE-2026-39961 affects the Aiven Operator and enables cross-namespace secret exfiltration through a confused deputy condition, breaking multi-tenancy and namespace isolation. An attacker starting from a constrained developer role could access high-value service account tokens, particularly in kube-system, and potentially obtain cluster-admin privileges. From there, they could deploy malicious DaemonSets, alter node settings, read cluster-wide data, and pivot into cloud environments through permissive IAM integrations such as AWS IAM Roles for Service Accounts.