44 matches found
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: teleport, rootlesskit, spire-server, gomplate, openbao, kine, ksops, melange, scorecard, buildkitd, prometheus, tekton-chains, grype, kargo, terragrunt, minio, pulumi-language-java, flux, docker, cilium, chezmoi, argocd-image-updater, eksctl, atlantis, kubernetes,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: teleport, rootlesskit, spire-server, crossplane-provider-aws-sqs, gomplate, openbao, kine, ksops, melange, scorecard, buildkitd, prometheus, tekton-chains, grype, kargo, terragrunt, minio, pulumi-language-java, crossplane-provider-aws-cloudformation, docker, cilium,...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: teleport, tempo, cluster-api-helm-controller, clickhouse-operator, secrets-store-csi-driver-provider-gcp, chartmuseum, spire-server, gomplate, flux-image-reflector-controller, openbao, seaweedfs, tailscale, temporal-server, octo-sts, envoy-ratelimit, kine, ksops,...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: teleport, tempo, cluster-api-helm-controller, clickhouse-operator, secrets-store-csi-driver-provider-gcp, chartmuseum, spire-server, gomplate, flux-image-reflector-controller, openbao, seaweedfs, tailscale, temporal-server, octo-sts, envoy-ratelimit, kine, ksops,...
SUSE CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
EUVD-2026-21150
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109
CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109: Improper Authentication
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: volsync, dkron, vault-env, teleport-operator-fips, weaviate, rancher-webhook-fips, ansible-operator, kubescape-server, k9s, kube-arangodb, flux-source-controller-fips, harbor, terragrunt, cloudbeat, verticadb-operator-fips, tekton-pipelines-fips, k6-operator-fips,...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: kafkaexporter, nri-couchbase, chartmuseum, cni-plugins, octo-sts, fluent-bit-plugin-loki, spire-controller-manager, nri-rabbitmq, nri-cassandra, fq, yq, aws-application-networking-k8s, glow, kustomize, cloud-provider-aws, lvm-driver, go-licenses, wuzz, kube-vip,...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: timoni, protoc-gen-go-grpc, kube-rbac-proxy-fips, crossplane-provider-aws-dynamodb, prometheus-stackdriver-exporter, frp, weaviate, prometheus-postgres-exporter-fips, temporal-ui-server-fips, gitness, k9s, cluster-proportional-autoscaler, flux-source-controller,...