CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: policy-controller, terraform-provider-azuread, crossplane-provider-family-azure, openbao, flux-source-controller, grype, opentofu, goreleaser, crossplane-provider-aws-cloudfront, pulumi, sops, crossplane, cluster-api, pulumi-language-java, kyverno-notation-aws,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, crossplane-provider-aws-eks-fips, grype, omni, datadog-agent-fips, crossplane-provider-aws-efs, melange, grype-db, crossplane-provider-aws-rds, flux-image-automation-controller, flux-source-controller, boring-registry-fips, opentofu-fips, sops,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, crossplane-provider-aws-eks-fips, grype, omni, datadog-agent-fips, crossplane-provider-aws-efs, melange, grype-db, crossplane-provider-aws-rds, flux-image-automation-controller, flux-source-controller, boring-registry-fips, opentofu-fips, sops,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-kms-plugin, tkn, caddy-fips, mattermost-fips, temporal-server, sops, elastic-agent, kyverno-policy-reporter-fips, nuclei, tkn-fips, croc, spicedb, temporal, elastic-agent-fips, prometheus-mysqld-exporter, terragrunt, loki-fips, reports-server, caddy, dex-fips,...

SUSE CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: k8sgateway, ingress-nginx-controller-fips, bom, datadog-agent-fips, external-dns-fips, flux-image-automation-controller, mattermost-fips, gitlab-workhorse-ce, opentofu-fips, thanos-operator, helm-operator, ferretdb, elastic-agent, kube-arangodb, timoni, croc,...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator, flux-operator-fips...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator, flux-operator-fips...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

CVE-2026-23990 affects the Flux Operator Web UI in Flux CD/ControlPlane prior to 0.40.0. The issue is a privilege-escalation through an impersonation bypass when OIDC tokens provide empty/invalid claims that CEL expressions can evaluate to empty; then Kubernetes client-go fails to add impersonati...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via improper validation of OIDC token claims after processing through CEL expressions. An attacker can gain unauthorized operator-level read access and perform actions such as suspend, resume, or reconcile by...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via improper validation of OIDC token claims after processing through CEL expressions. An attacker can gain unauthorized operator-level read access and perform actions such as suspend, resume, or reconcile by...