GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips, opencost, livekit-cli, flux-operator-fips, ferretdb, gitlab-workhorse-ce, datadog-agent, flux-operator, osv-scanner, glab, datadog-agent-fips, jaeger...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips, opencost, livekit-cli, flux-operator-fips, ferretdb, gitlab-workhorse-ce, datadog-agent, flux-operator, osv-scanner, glab, datadog-agent-fips, jaeger...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, opencost-fips, gptscript, jaeger-fips, opencost, flux-operator-fips, ferretdb, github-mcp-server, gitlab-workhorse-ce, datadog-agent, flux-operator, osv-scanner, datadog-agent-fips, jaeger...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, opencost-fips, gptscript, jaeger-fips, opencost, flux-operator-fips, ferretdb, github-mcp-server, gitlab-workhorse-ce, datadog-agent, flux-operator, osv-scanner, datadog-agent-fips, jaeger...

SUSE CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator-fips, flux-operator...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, flux-operator...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

CVE-2026-23990 affects the Flux Operator Web UI in Flux CD/ControlPlane prior to 0.40.0. The issue is a privilege-escalation through an impersonation bypass when OIDC tokens provide empty/invalid claims that CEL expressions can evaluate to empty; then Kubernetes client-go fails to add impersonati...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

EUVD-2026-4140

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims...

GHSA-4XH5-JCJ2-CH8Q Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. After OIDC token claims are processed through CEL expressions, there...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via improper validation of OIDC token claims after processing through CEL expressions. An attacker can gain unauthorized operator-level read access and perform actions such as suspend, resume, or reconcile by...