Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer-fips, kiali, kubevela-fips, task, task-fips, longhorn-manager, docker-cli-buildx, envoy-gateway-fips, vault-fips, boring-registry, grype-fips, tekton-chains, cluster-api-gcp-controller, zarf, kube-conformance, vitess, opencost-fips,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: podman, nri-rabbitmq, gitsign, tempo, flannel-cni-plugin, aws-efs-csi-driver, gitness, dagdotdev, neuvector-dbgen, flux, neuvector-scanner, sftpgo-plugin-kms, git-credential-oauth, k8ssandra-operator, sbom-scorecard, cri-tools, dataplaneapi, litefs, sftpgo-plugin-aut...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane, buf, prometheus-elasticsearch-exporter, boring-registry, kargo, volume-modifier-for-k8s, crossplane-provider-family-aws, cilium-cli, nri-discovery-kubernetes, tekton-chains, prometheus-redis-exporter-fips, kiam, kube-oidc-proxy, zarf, kots,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: melange, snyk-cli, pulumi-kubernetes-operator, task, flux-notification-controller, argo-workflows, argo-events-fips, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: melange, snyk-cli, pulumi-kubernetes-operator, task, flux-notification-controller, argo-workflows, argo-events-fips, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: melange, argo-workflows, flux-notification-controller, pulumi-kubernetes-operator, task, argo-events, snyk-cli...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: conftest-fips, terraform-provider-sendgrid-fips, slsa-verifier, prometheus-adapter-fips, kubernetes-csi-livenessprobe, kubeflow-fips, dgraph, kubernetes-csi-livenessprobe-fips, metrics-server-fips, plutono-fips, volume-modifier-for-k8s-fips, vault-csi-provider,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: scorecard, cortex, kubescape, src, k3d, buildkitd, up, kubevela, dgraph, kubeflow, slsa-verifier, terraform-provider-sendgrid, spark-operator, aactl...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: ollama, cue, pulumi-kubernetes-operator, aws-efs-csi-driver, gitness, scorecard, skaffold, kubescape, mc, k3d, gomplate, helm, kind, fuse-overlayfs-snapshotter, envoy-ratelimit, hey, nodetaint, dex, nats, kubewatch, sigstore-scaffolding, flux-helm-controller, kaf, bo...