42 matches found
CVE-2026-34986 vulnerabilities
Vulnerabilities for packages: rabbitmq-messaging-topology-operator-fips, image-factory, azcopy, ratify-fips, spire-controller-manager-fips, conftest-fips, chainloop-control-plane, nginx-kubernetes-ingress-fips, fulcio, milvus, velero-plugin-for-gcp-fips, knative-kafka-broker-fips, opentofu,...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: flux, crossplane-provider-azure-authorization, gitea, argo-events, nfpm, crossplane-provider-aws-cloudfront, extism, gitness, crossplane, rclone, crossplane-provider-aws-dynamodb, rancher-fleet, flux-source-controller, syft, crossplane-provider-aws-elasticache, dagge...
GHSA-Q9HV-HPM4-HJ6X vulnerabilities
Vulnerabilities for packages: flux, crossplane-provider-azure-authorization, gitea, argo-events, nfpm, crossplane-provider-aws-cloudfront, extism, gitness, crossplane, rclone, crossplane-provider-aws-dynamodb, rancher-fleet, flux-source-controller, syft, crossplane-provider-aws-elasticache, dagge...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-dynamodb-fips, cg, crossplane-provider-aws-elasticache-fips, flux, rancher-fleet, image-factory, trivy, buildkitd, cluster-api, terraform-provider-pagerduty, ratify-fips, gitlab-rails-ce-fips, trufflehog, argo-events-fips,...
BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...
BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...
BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...
EUVD-2022-3043
Malicious code in bioql PyPI...
GHSA-J5PM-7495-QMR3 vulnerabilities
Vulnerabilities for packages: flux, fuse-overlayfs-snapshotter, harbor-scanner-trivy-fips, kube-bench, conftest-fips, databricks-cli-fips, nri-nagios, falco-exporter-fips, trino, cluster-api-helm-controller, fulcio, victoriametrics-operator, apm-server, eksctl, gotestsum, opentofu, kyverno,...
CVE-2022-24877
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...
GHSA-32GQ-X56H-299C vulnerabilities
Vulnerabilities for packages: grafana-fips, flux-kustomize-controller, litestream, sops-fips, chezmoi, age-fips, grafana, age, ksops, sops, flux-kustomize-controller-fips...
GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: flux, flux-image-reflector-controller, secrets-store-csi-driver-provider-azure, airflow, sops, step, tekton-chains, terragrunt, thanos, argo-events, buildkitd, external-secrets-operator, zarf, hugo-extended, opentelemetry-collector-contrib, fulcio, restic,...
BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...
BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: flux, kubeflow-fips, flux-notification-controller, fuse-overlayfs-snapshotter, kube-bench, conftest-fips, envoy-ratelimit-fips, fulcio, pulumi-kubernetes-operator, eksctl, opentofu, kube-state-metrics-fips, flux-helm-controller, guac, cloudflared,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: vault-csi-provider, terraform-provider-sendgrid, kube-oidc-proxy, kubeflow-fips, dgraph, src, buildkitd, metrics-server-fips, ipfs, slsa-verifier, aws-efs-csi-driver-fips, conftest-fips, kubevela, up, volume-modifier-for-k8s-fips, bank-vaults-fips,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: coredns, conftest, sigstore-scaffolding, minio, kind, gitness, haproxy-ingress, spark-operator, flux-source-controller, wireguard-go, cosign, kubernetes-csi-livenessprobe, pulumi-language-dotnet, pulumi, flux-helm-controller, kubeflow-katib, nghttp2,...
Improper path handling in Kustomization files allows for denial of service
The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...
GHSA-VVMQ-FWMG-2GJC Improper kubeconfig validation allows arbitrary code execution
Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...