Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: spire-server-fips, scorecard, terraform-fips, coredns, crossplane-provider-gcp-fips, eck-operator-fips, kong-ingress-controller, minio, ceph-csi-operator, flyte, sops, azcopy-fips, skaffold-fips, buildkitd, helm-operator-fips, ratify-fips, temporal-fips, blob-csi-fip...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: dive, cortex, flannel-cni-plugin, crane, sbom-convert, postgres-operator, age, smarter-device-manager, k6, aws-application-networking-k8s, trino, gitea, kserve-rest-proxy, timoni, atlantis, kube-logging-operator, velero-plugin-for-microsoft-azure, haproxy-ingress,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: spire-server-fips, scorecard, vertical-pod-autoscaler, terraform-provider-sendgrid, gitness, minio, kots, sops, ctop, rabbitmq-cluster-operator, buildkitd, helm-operator-fips, kubernetes-dns-node-cache, prometheus-alertmanager-fips, temporal-fips,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-events, flux-notification-controller, pulumi-kubernetes-operator, task, argo-events-fips, argo-workflows, melange, snyk-cli...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, argo-workflows, task, flux-notification-controller, argo-events, pulumi-kubernetes-operator, melange...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-events, flux-notification-controller, pulumi-kubernetes-operator, task, argo-events-fips, argo-workflows, melange, snyk-cli...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe-fips, metrics-server-fips, bank-vaults-fips, falcoctl-fips, kubeflow-fips, kubescape, scorecard, kubevela, prometheus-stackdriver-exporter, slsa-verifier, aactl, dgraph, kiam, terraform-provider-sendgrid, volume-modifier-for-k8s-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, up, spark-operator, slsa-verifier, dgraph, cortex, kubescape, k3d, aactl, kubevela, scorecard, kubeflow, src, buildkitd...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: cortex, kaf, memcached-exporter, terraform, weaviate, hugo, flux-kustomize-controller, flux-helm-controller, nghttp2, rqlite, conftest, atlantis, haproxy-ingress, aactl, kpt, nri-prometheus, hey, buildkitd, flux-source-controller, nginx-mainline,...