Decryption doesn't fail when doing from unauthorized service account
vivekpd15 opened this issue · 2 comments
vivekpd15 commented
Describe the bug
A clear and concise description of what the bug is.
Versions used
Kamus (API images): 0.6.7.0
Kamus CLI: 0.3.0
Chart version: 0.4.8
KMS provider: AWS KMS
Kubernetes flavour and version: KOPS 1.15.12
To Reproduce
Steps to reproduce the behavior:
- Encrypt a key with kamus secret with namespace A and service account B
- Decrypt the key using namespace C and service account D
Expected behavior
Decryption should have failed. It successfully decrypted the key.
omerlh commented
Closing the issue as this is a security issue and should be reported according to our security policy. Please do not use GitHub issue for security reporting.