{
  "schemaVersion": "catalog-shared-check-receipt-v1",
  "subject": {
    "id": "elastic-eck-operator-3-4-0-default",
    "chart": "elastic/eck-operator",
    "version": "3.4.0",
    "base": "default",
    "renderPath": "recipes/elastic/eck-operator/3.4.0/revisions/default/r001/rendered/release-objects.yaml",
    "renderFileSHA256": "sha256:11bd8f291f9da0611bf6795dbbbe41a9e4e5ae9fe4cd58e9bad69dd883aee278"
  },
  "catalogReview": {
    "path": "recipes/elastic/eck-operator/3.4.0/revisions/default/r001/receipts/scan-receipt.yaml",
    "note": "Separate chart-specific Catalog review; not a cub check result."
  },
  "scannerResult": {
    "schema_version": "risk-scan-findings-v1",
    "surface": "cub-scan",
    "finding_count": 2,
    "findings": [
      {
        "id": "CCVE-2025-3752",
        "name": "StatefulSet does not disable automountServiceAccountToken",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "warning",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "StatefulSet",
          "name": "elastic-operator",
          "namespace": "default"
        },
        "message": "StatefulSet does not set automountServiceAccountToken: false; pods get unnecessary API credentials",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Set automountServiceAccountToken to false in the pod spec",
            "Only enable it for pods that genuinely need Kubernetes API access",
            "Use dedicated service accounts with minimal RBAC for pods that need API access"
          ],
          "commands": [
            "kubectl get statefulset <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-RBAC-0002"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Set automountServiceAccountToken to false in the pod spec",
          "command": "kubectl get statefulset <name> -n <namespace> -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'",
          "doc_ref": "cub-scan --explain CCVE-2025-3752"
        }
      },
      {
        "id": "CCVE-2025-4078",
        "name": "ClusterRole grants secrets read permissions",
        "category": "SECURITY",
        "track": "misconfiguration",
        "detection_method": "native_rule",
        "severity": "critical",
        "confidence": "high",
        "tool": "kubernetes",
        "resource": {
          "kind": "ClusterRole",
          "name": "elastic-operator",
          "namespace": "default"
        },
        "message": "ClusterRole grants secrets get/list, enabling credential exfiltration across namespaces",
        "remedy_type": "config_fix",
        "remedy_safety": "safe_auto",
        "remediation": {
          "steps": [
            "Remove secrets get/list permissions from ClusterRoles that do not require credential access",
            "Scope secret access to namespaced Role bindings where possible"
          ],
          "commands": [
            "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'"
          ]
        },
        "evidence_source": "native",
        "control_ids": [
          "CTRL-RBAC-0001"
        ],
        "action_type": "mutating",
        "next_step": {
          "action": "apply_fix",
          "description": "Remove secrets get/list permissions from ClusterRoles that do not require credential access",
          "command": "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'",
          "doc_ref": "cub-scan --explain CCVE-2025-4078"
        }
      }
    ],
    "provenance": {
      "source": "cub-scan",
      "source_version": "v0.7.3",
      "scan_time": "2026-08-24T16:00:27Z",
      "catalog_version": "risk-catalog-v1.json@7ff79a126ad9"
    },
    "pattern_bundle": {
      "schema_version": "bundle-manifest-v1",
      "version": "v0.7.3",
      "source_repo": "confighubai/confighub-scan",
      "manifest_sha256": "0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8",
      "catalog_sha256": "7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba"
    },
    "input": {
      "object_count": 22,
      "object_set_sha256": "sha256:7009685802eae9f129d75246730bcf7efaa529da6a0b9b9a3e0511d3409a5293"
    }
  }
}