GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: kots, mapotf-fips, redpanda-console, steampipe, syft-fips, trufflehog-fips, mapotf, zot, coder, flux, trivy-fips, jfrog-cli, src-fingerprint-fips, cerbos-fips, skaffold-fips, chainloop-cli-fips, pulumi-language-java, flux-notification-controller, gitea-fips, dagger,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: kots, mapotf-fips, redpanda-console, steampipe, syft-fips, trufflehog-fips, mapotf, zot, coder, flux, trivy-fips, jfrog-cli, src-fingerprint-fips, cerbos-fips, skaffold-fips, chainloop-cli-fips, pulumi-language-java, flux-notification-controller, gitea-fips, dagger,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: kots, mapotf-fips, redpanda-console, steampipe, syft-fips, trufflehog-fips, mapotf, zot, coder, flux, trivy-fips, jfrog-cli, src-fingerprint-fips, cerbos-fips, skaffold-fips, chainloop-cli-fips, pulumi-language-java, flux-notification-controller, gitea-fips, dagger,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: kots, mapotf-fips, redpanda-console, steampipe, syft-fips, trufflehog-fips, mapotf, zot, coder, flux, trivy-fips, jfrog-cli, src-fingerprint-fips, cerbos-fips, skaffold-fips, chainloop-cli-fips, pulumi-language-java, flux-notification-controller, gitea-fips, dagger,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: gomplate, k9s, scorecard, kots, src-fingerprint, gptscript, teleport, flux-image-automation-controller, kaniko, argo-workflows, witness, trufflehog, kyverno, goreleaser, gitsign, kubevela, gitea, xeol, tfsec, guac, trivy-operator, zot, flux-source-controller, syft,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: gomplate, k9s, scorecard, kots, src-fingerprint, gptscript, teleport, flux-image-automation-controller, kaniko, argo-workflows, witness, trufflehog, kyverno, goreleaser, gitsign, kubevela, gitea, xeol, tfsec, guac, trivy-operator, zot, flux-source-controller, syft,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: gomplate, k9s, scorecard, kots, src-fingerprint, gptscript, teleport, flux-image-automation-controller, kaniko, argo-workflows, witness, trufflehog, kyverno, goreleaser, gitsign, kubevela, gitea, xeol, tfsec, guac, trivy-operator, zot, flux-source-controller, syft,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: gomplate, k9s, scorecard, kots, src-fingerprint, gptscript, teleport, flux-image-automation-controller, kaniko, argo-workflows, witness, trufflehog, kyverno, goreleaser, gitsign, kubevela, gitea, xeol, tfsec, guac, trivy-operator, zot, flux-source-controller, syft,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gomplate, istio, rancher, sops, kots, witness, kubernetes-dashboard, rancher-machine, podman, step-kms-plugin, flux-kustomize-controller, spire-server, cilium-cli, containerd, cluster-api-azure-controller, telegraf, gitlab-runner, cert-manager, prometheus, ko, chezmo...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: gomplate, istio, rancher, sops, kots, witness, kubernetes-dashboard, rancher-machine, traefik, podman, step-kms-plugin, flux-kustomize-controller, spire-server, cilium-cli, containerd, cluster-api-azure-controller, telegraf, gitlab-runner, cert-manager, prometheus, k...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: gomplate, rancher, octo-sts, tetragon, dbmate, kots, dgraph, addon-resizer, argo-workflows, witness, bank-vaults, vcluster, kube-vip-cloud-provider, cri-tools, rancher-machine, xeol, keda, traefik, podman, step-kms-plugin, flux-kustomize-controller, spire-server,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: gomplate, rancher, octo-sts, tetragon, dbmate, kots, dgraph, addon-resizer, argo-workflows, witness, bank-vaults, vcluster, kube-vip-cloud-provider, cri-tools, rancher-machine, xeol, keda, traefik, podman, step-kms-plugin, flux-kustomize-controller, spire-server,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...