**Fixed Versions**:
  - kube-apiserver v1.29.4
  - kube-apiserver v1.28.9
  - kube-apiserver v1.27.13

This vulnerability was reported by tha3e1vl.


**CVSS Rating:** Low (2.7) [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

## Changes by Kind

### Feature

* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

* Fixes issue where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. ([#86412](https://github.com/kubernetes/kubernetes/pull/86412), [@weinong](https://github.com/weinong))
    * The audience claim before this fix has "spn:" prefix. After this fix, "spn:" prefix is omitted.

    end
    Note over dep: After yield
    opt Handle other exception
        dep -->> dep: Handle exception, can't change response. E.g. close DB session.
    end
```

The new execution flow can be found in the docs: [Execution of dependencies with `yield`](https://fastapi.tiangolo.com/tutorial/dependencies/dependencies-with-yield/#execution-of-dependencies-with-yield).

### Features

	quarkus/extensions/kotlin/runtime/pom.xml
	quarkus/extensions/arc/runtime/pom.xml
	quarkus/test-framework/junit5-internal/pom.xml
quarkus/integration-tests/oidc-code-flow/pom.xml
	quarkus/extensions/oidc/runtime/pom.xml
	quarkus/extensions/smallrye-jwt-build/runtime/pom.xml
	quarkus/extensions/resteasy-classic/resteasy-jackson/runtime/pom.xml
	quarkus/extensions/micrometer/runtime/pom.xml

the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.

  The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.

pkg go/ast, type SendStmt struct, Value Expr
pkg go/ast, type SliceExpr struct
pkg go/ast, type SliceExpr struct, High Expr
pkg go/ast, type SliceExpr struct, Lbrack token.Pos
pkg go/ast, type SliceExpr struct, Low Expr
pkg go/ast, type SliceExpr struct, Rbrack token.Pos
pkg go/ast, type SliceExpr struct, X Expr
pkg go/ast, type Spec interface, End() token.Pos
pkg go/ast, type Spec interface, Pos() token.Pos