🛡️ AADSec — Security Audit Report

Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.

An exposed credential can be used by an attacker to gain unauthorised access to the associated service, potentially leading to data breach, service abuse, or further lateral movement.

1. Revoke and rotate the exposed credential immediately. 2. Remove the secret from the source code and replace with a secrets manager reference. 3. Search CI/CD logs and build artefacts for the exposed value. 4. If the secret was committed to Git history, consider a history purge (git-filter-repo).

• https://gitleaks.io
• https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_credentials

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

A vulnerable dependency can be exploited by an attacker to compromise application integrity, trigger denial-of-service, or gain unauthorised access, depending on the nature of the vulnerability.

Upgrade lodash to version 4.17.21 or later.

• https://avd.aquasec.com/nvd/cve-2021-23337
• https://access.redhat.com/security/cve/CVE-2021-23337
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-35jh-r3h4-6jhm
• https://github.com/lodash/lodash
• https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js
• https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
• https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
• https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge impo…

A vulnerable dependency can be exploited by an attacker to compromise application integrity, trigger denial-of-service, or gain unauthorised access, depending on the nature of the vulnerability.

Upgrade lodash to version 4.18.0 or later.

• https://avd.aquasec.com/nvd/cve-2026-4800
• https://access.redhat.com/errata/RHSA-2026:10131
• https://access.redhat.com/errata/RHSA-2026:10175
• https://access.redhat.com/errata/RHSA-2026:10710
• https://access.redhat.com/errata/RHSA-2026:10713
• https://access.redhat.com/errata/RHSA-2026:11454
• https://access.redhat.com/errata/RHSA-2026:11469
• https://access.redhat.com/errata/RHSA-2026:11470
• https://access.redhat.com/errata/RHSA-2026:11471
• https://access.redhat.com/errata/RHSA-2026:11493

eval() executes arbitrary JavaScript. If the argument is derived from user input or an external source, this leads to code injection.

Unsafe coding patterns can be exploited by an attacker to execute arbitrary code, inject malicious data, or bypass security controls, depending on where and how the vulnerable code is reachable.

Avoid eval(). Use JSON.parse() for data parsing, or redesign the feature to eliminate dynamic code evaluation.

child_process.exec() passes its argument to a shell, enabling injection if the command string contains any user-controlled data.

Unsafe coding patterns can be exploited by an attacker to execute arbitrary code, inject malicious data, or bypass security controls, depending on where and how the vulnerable code is reachable.

Use child_process.execFile() or child_process.spawn() with arguments passed as a separate array, never as a concatenated string.

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

A vulnerable dependency can be exploited by an attacker to compromise application integrity, trigger denial-of-service, or gain unauthorised access, depending on the nature of the vulnerability.

Upgrade lodash to version 4.17.21 or later.

• https://avd.aquasec.com/nvd/cve-2020-28500
• https://access.redhat.com/security/cve/CVE-2020-28500
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-29mw-wpgm-hmr9
• https://github.com/github/advisory-database/pull/6139
• https://github.com/lodash/lodash
• https://github.com/lodash/lodash/blob/npm/trimEnd.js
• https://github.com/lodash/lodash/blob/npm/trimEnd.js#L8
• https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
• https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23

A vulnerable dependency can be exploited by an attacker to compromise application integrity, trigger denial-of-service, or gain unauthorised access, depending on the nature of the vulnerability.

Upgrade lodash to version 4.17.23 or later.

• https://avd.aquasec.com/nvd/cve-2025-13465
• https://access.redhat.com/errata/RHSA-2026:11414
• https://access.redhat.com/errata/RHSA-2026:13542
• https://access.redhat.com/errata/RHSA-2026:13548
• https://access.redhat.com/errata/RHSA-2026:13829
• https://access.redhat.com/errata/RHSA-2026:14774
• https://access.redhat.com/errata/RHSA-2026:14870
• https://access.redhat.com/errata/RHSA-2026:14871
• https://access.redhat.com/errata/RHSA-2026:15091
• https://access.redhat.com/errata/RHSA-2026:17469

Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype proper…

A vulnerable dependency can be exploited by an attacker to compromise application integrity, trigger denial-of-service, or gain unauthorised access, depending on the nature of the vulnerability.

Upgrade lodash to version 4.18.0 or later.

• https://avd.aquasec.com/nvd/cve-2026-2950
• https://access.redhat.com/security/cve/CVE-2026-2950
• https://github.com/lodash/lodash
• https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
• https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
• https://nvd.nist.gov/vuln/detail/CVE-2026-2950
• https://ubuntu.com/security/notices/USN-8411-1
• https://www.cve.org/CVERecord?id=CVE-2026-2950

Ensure S3 buckets should have event notifications enabled

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure all data stored in the S3 bucket have versioning enabled

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure that S3 bucket has a Public Access block

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure that S3 bucket has cross-region replication enabled

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure that S3 buckets are encrypted with KMS by default

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure that an S3 bucket has a lifecycle configuration

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure the S3 bucket has access logging enabled

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Apply security context to your containers

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Apply security context to your pods and containers

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

CPU limits should be set

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

CPU requests should be set

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Containers should not run with allowPrivilegeEscalation

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Containers should not share the host network namespace

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Containers should run as a high UID to avoid host conflict

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure that Service Account Tokens are only mounted where necessary

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Ensure that the seccomp profile is set to docker/default or runtime/default

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Image Pull Policy should be Always

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Image should use digest

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Liveness Probe Should be Configured

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Memory limits should be set

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Memory requests should be set

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Minimize the admission of containers with capabilities assigned

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Minimize the admission of containers with the NET_RAW capability

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Minimize the admission of pods which lack an associated NetworkPolicy

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Minimize the admission of root containers

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Readiness Probe Should be Configured

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

The default namespace should not be used

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.

Use read-only filesystem for containers where possible

An IaC misconfiguration can result in resources being exposed to the internet, insufficient access controls, missing audit logging, or insecure defaults that may be exploited by an attacker with access to the provisioned infrastructure.

Review the IaC resource and update the configuration according to the check recommendation. Refer to the check guideline for specific remediation steps.