Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: trivy, hydra-fips, spicedb-operator, zitadel, docker, cloud-provider-azure-fips, cloud-provider-azure, gitlab-operator, scorecard, gitlab-operator-fips, grype-db, prometheus-adapter, descheduler-fips, etcd, buildkitd, docker-compose, rke2-runtime, k6,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: runc, minify, sftpgo-plugin-kms, kube-vip, wire-go, ini-file, rabbitmq-messaging-topology-operator, src-fingerprint, pdfcpu, policy-controller, temporal-ui-server, controller-gen, kapp, capslock, kwok, kind, tflint, yq, dataplaneapi, k9s, kubernetes,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: trivy, flux-kustomize-controller, docker, scorecard, crossplane-provider-aws-dynamodb, kubeflow, prometheus-redis-exporter, pulumi-language-dotnet, doppler-kubernetes-operator, rabbitmq-cluster-operator, grpcurl, slsa-verifier, gitness, k8ssandra-operator,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, snyk-cli, argo-events-fips, melange, task, pulumi-kubernetes-operator, argo-workflows, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: task, pulumi-kubernetes-operator, snyk-cli, argo-workflows, argo-events, melange, flux-notification-controller...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, snyk-cli, argo-events-fips, melange, task, pulumi-kubernetes-operator, argo-workflows, argo-events...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, kiam, prometheus-stackdriver-exporter, kubevela, metrics-server-fips, scorecard, kubeflow, up, kubernetes-csi-livenessprobe-fips, kube-oidc-proxy, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, dgraph, slsa-verifier,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, src, buildkitd, kubescape, cortex, k3d, kubevela, spark-operator, dgraph, up, kubeflow, aactl, slsa-verifier, scorecard...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: cosign, memcached-exporter, spark-operator, kubeflow, skaffold, flux-notification-controller, gke-gcloud-auth-plugin, kind, metacontroller, conftest, pulumi-kubernetes-operator, pulumi, flux-helm-controller, grpcurl, ip-masq-agent, kots, pulumi-language-yaml,...