GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: guac, crossplane-provider-aws-eks, slsa-verifier, cloud-provider-aws, cluster-api-azure-controller, loki, crossplane-provider-family-azure, opentelemetry-collector, flux-notification-controller, glab, openbao, argocd-image-updater, gitea, gitlab-kas,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: age, guac, slsa-verifier, cloud-provider-aws, cluster-api-azure-controller, loki, crossplane-provider-family-azure, opentelemetry-collector, flux-notification-controller, glab, openbao, argocd-image-updater, gitea, gitlab-kas, kubernetes-dashboard, kyverno,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, guac, crossplane-provider-aws-eks, slsa-verifier, xeol, cloud-provider-aws, loki, crossplane-provider-family-azure, cloud-provider-azure, kserve-modelmesh-serving, flux-notification-controller, cluster-autoscaler, openbao,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, guac, crossplane-provider-aws-eks, slsa-verifier, xeol, cloud-provider-aws, loki, crossplane-provider-family-azure, cloud-provider-azure, kserve-modelmesh-serving, flux-notification-controller, cluster-autoscaler, openbao,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: cosign, flux-source-controller-fips, rke2-runtime, juicefs, trivy-operator-fips, aws-node-termination-handler-fips, falcosidekick-fips, podinfo-fips, coredns, rancher-system-agent, coredns-fips, falcosidekick, prometheus-alertmanager, rekor, zot, jobset,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: age, jaeger, petname, yq, go-md2man, kind, sftpgo-plugin-eventsearch, wire-go, protoc-gen-go-grpc, stakater-reloader, whereabouts, k9s, newrelic-nri-statsd, cni-plugins, nats, gptscript, helm-docs, gops, paranoia, secrets-store-csi-driver-provider-azure,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubeflow-fips, cosign, kube-state-metrics, newrelic-nri-kube-events, configmap-reload, falcosidekick-fips, kaf, crossplane-provider-family-aws, crossplane-provider-aws-iam, atlantis-fips, coredns, falcosidekick, prometheus-alertmanager, pgpool2exporter-fips, rekor,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, melange, task, flux-notification-controller, argo-events, snyk-cli, argo-events-fips...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, pulumi-kubernetes-operator, melange, flux-notification-controller, argo-events, task, argo-workflows...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, melange, task, flux-notification-controller, argo-events, snyk-cli, argo-events-fips...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-blackbox-exporter, slsa-verifier, scorecard, aactl, kubevela, src, kubeflow, kubescape, falco, up, buildkitd, terraform-provider-sendgrid, spark-operator, dgraph, cortex, k3d...