CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

notification-controller 数据伪造问题漏洞

Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: kiali-fips, headlamp, pulumi, opencost-fips, grype, cert-manager, vault-secrets-webhook, trivy-operator-fips, flux-kustomize-controller-fips, cloudbeat-fips, step-fips, cloudflared, vault, skaffold, cephcsi, prometheus-podman-exporter-fips, ko, rook-fips, fulcio,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: grype-fips, kubescape, teleport, apko-fips, packer-fips, snyk-cli, pulumi, skaffold-fips, xeol-fips, grype, flux-image-automation-controller, chainctl, gomplate-fips, tfsec, kots, google-osconfig-agent, steampipe, gitea, trivy-operator-fips, gitlab-rails-ce-fips,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: grype-fips, kubescape, teleport, apko-fips, packer-fips, snyk-cli, pulumi, skaffold-fips, xeol-fips, grype, flux-image-automation-controller, chainctl, gomplate-fips, tfsec, kots, google-osconfig-agent, steampipe, gitea, trivy-operator-fips, gitlab-rails-ce-fips,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: grype-fips, kubescape, teleport, apko-fips, packer-fips, snyk-cli, pulumi, skaffold-fips, xeol-fips, grype, flux-image-automation-controller, chainctl, gomplate-fips, tfsec, kots, google-osconfig-agent, steampipe, gitea, trivy-operator-fips, gitlab-rails-ce-fips,...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: ferretdb, osv-scanner, jaeger, glab, opencost, datadog-agent...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: ferretdb, osv-scanner, jaeger, glab, opencost, datadog-agent...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: ferretdb, osv-scanner, jaeger, glab, opencost, datadog-agent...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, ferretdb, jaeger, gitlab-workhorse-ce-fips, jaeger-fips, glab, osv-scanner, datadog-agent, flux-operator-fips, flux-operator, gitlab-workhorse-ce, opencost, livekit-cli, opencost-fips...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, ferretdb, jaeger, gitlab-workhorse-ce-fips, jaeger-fips, glab, osv-scanner, datadog-agent, flux-operator-fips, flux-operator, gitlab-workhorse-ce, opencost, livekit-cli, opencost-fips...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, ferretdb, jaeger, gitlab-workhorse-ce-fips, jaeger-fips, glab, osv-scanner, datadog-agent, flux-operator-fips, flux-operator, gitlab-workhorse-ce, opencost, livekit-cli, opencost-fips...

CVE-2026-22737 Spring Framework Improper Path Limitation with Script View Templates

Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: localstack, stern, crossplane-provider-aws-kinesis, flux-notification-controller, terraform-provider-random-fips, kyverno-policy-reporter-kyverno-plugin-fips, sriov-network-device-plugin, nova-fips, kube-logging-operator-custom-runner-fips,...