CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: osv-scanner, yunikorn-k8shim, gitness, rancher-fleet, temporal-ui-server, vault-env, kubernetes-csi-external-health-monitor, dgraph, kubernetes-csi-external-attacher, litestream, descheduler, swagger, gh, keda, fscrypt, kubernetes-csi-livenessprobe, net-kourier,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: chisel, oras, addon-resizer, calico, yunikorn-web, kubernetes-csi-external-attacher, chezmoi, descheduler, dynamic-localpv-provisioner, podman, scorecard, vault-secrets-webhook, grpcurl, cert-exporter, nfs-subdir-external-provisioner, rqlite, incert,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: osv-scanner, yunikorn-k8shim, gitness, rancher-fleet, temporal-ui-server, vault-env, kubernetes-csi-external-health-monitor, dgraph, kubernetes-csi-external-attacher, litestream, descheduler, swagger, gh, keda, fscrypt, kubernetes-csi-livenessprobe, net-kourier,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: flux-fips, argo-workflows, keda-fips, runc, newrelic-fluent-bit-output, azure-aad-pod-identity-mic, knative-eventing, telegraf, karpenter-fips, gitlab-workhorse-ce-fips, harbor, cloud-provider-azure-fips, jaeger-fips, buildkite-agent-fips, gitlab-rails-ce,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: flux-fips, argo-workflows, keda-fips, runc, newrelic-fluent-bit-output, azure-aad-pod-identity-mic, knative-eventing, telegraf, karpenter-fips, gitlab-workhorse-ce-fips, harbor, cloud-provider-azure-fips, jaeger-fips, buildkite-agent-fips, gitlab-rails-ce,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: pgwatch, flux-image-reflector-controller-fips, grafana-rollout-operator, omnibump, kyverno-policy-reporter-plugins-kyverno, flux-source-controller-fips, aws-iam-authenticator, oras-fips, karpenter-fips, victoriametrics, omni-fips, flux-operator, flux-source-controlle...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: pgwatch, flux-image-reflector-controller-fips, grafana-rollout-operator, omnibump, kyverno-policy-reporter-plugins-kyverno, flux-source-controller-fips, aws-iam-authenticator, oras-fips, karpenter-fips, victoriametrics, omni-fips, flux-operator, flux-source-controlle...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: buildah, argo-workflows, keda-fips, bom, envoy-gateway, harbor, jaeger-fips, buildkite-agent-fips, rancher-fleet-fips, gitlab-operator, kubescape, nerdctl-fips, chartmuseum, tofu-controller, vault-secrets-operator, grafana-operator-fips, opentofu-fips, grafana,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: buildah, argo-workflows, keda-fips, bom, envoy-gateway, harbor, jaeger-fips, buildkite-agent-fips, rancher-fleet-fips, gitlab-operator, kubescape, nerdctl-fips, chartmuseum, tofu-controller, vault-secrets-operator, grafana-operator-fips, opentofu-fips, grafana,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kube-vip, jobset-fips, buildah, grafana-rollout-operator, kcp, dynamic-localpv-provisioner-fips, crossplane-provider-aws-elbv2, container-object-storage-interface-fips, prometheus-node-exporter-fips, chronyexporter, argo-workflows, keda-fips, tempo-fips, bom, kuberlr...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

notification-controller 数据伪造问题漏洞

Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...