GO-2026-5775 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router, commercial-kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, cosmo-router-fips, karma-fips, karma, kyverno...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router, commercial-kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, cosmo-router-fips, karma-fips, karma, kyverno...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, telegraf, kyverno, karma...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, telegraf, kyverno, karma...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: db-operator, ghaudit, traefik, crossplane-provider-family-aws, aws-eks-pod-identity-agent, crossplane-provider-aws-sns, harbor-registry, kubernetes-dashboard-api, wuzz, terraform-provider-time, tetragon, terraform-provider-pagerduty, container-object-storage-interfac...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: omnibump, mariadb-operator, tailscale, flux-notification-controller, victoriametrics-cluster, grafana-rollout-operator, supercronic, secrets-store-csi-driver-provider-aws, mountpoint-s3-csi-driver, ingress-nginx-controller, polaris, actions-runner-controller,...

GO-2022-0960 Flux CLI Workload Injection in github.com/fluxcd/flux2

Flux CLI Workload Injection in github.com/fluxcd/flux2...

GO-2022-0447 Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2

Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2...

source-controller leaks Azure Storage SAS token into logs

Impact When source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access t...

GO-2022-1071 Denial of service in flux controllers in github.com/fluxcd modules

Flux controllers are vulnerable to a denial of service attack. Users that have permissions to change Flux's objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured variations of these fields, causing the...

fluxcd:fuzz_gitlab: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4621828840882176 Project: fluxcd Fuzzing Engine: libFuzzer Fuzz Target: fuzzgitlab Job Type: libfuzzerasanfluxcd Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

Denial Of Service (DoS)

github.com/fluxcd is vulnerable to Denial of Service. The vulnerability exists due to the lack of data fields validation in the metav1.Duration parameter in multiple fluxcd repositories which allows an attacker to cause an application crash...

fluxcd:fuzz_gitlab: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4832667908833280 Project: fluxcd Fuzzing Engine: libFuzzer Fuzz Target: fuzzgitlab Job Type: libfuzzerasanfluxcd Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

Denial Of Service (DoS)

github.com/fluxcd/helm-controller and github.com/fluxcd/flux2 are vulnerable to denial of service DoS attacks. A remote authenticated attacker is able to cause a system panic by supplying specific data inputs, resulting in denial of service conditions via high memory consumption...

Path Traversal

github.com/fluxcd/flux2 is vulnerable to path traversal. The vulnerability exists because the library does not properly handle the user-supplied input, allowing an attacker to access files outside the expected directory and replace the flux deployment information with arbitrary content...

fluxcd:fuzz_gitlab: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5520154049511424 Project: fluxcd Fuzzing Engine: libFuzzer Fuzz Target: fuzzgitlab Job Type: libfuzzerasanfluxcd Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address ASAN Crash...

Remote Code Execution (RCE)

github.com/fluxcd is vulnerable to remote code execution. The vulnerability exists due to a lack of validation of access and sanitization of flagging inputs which allows a malicious user to inject and execute arbitrary javascript code...

fluxcd:fuzz_azure_devops: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4845932087214080 Project: fluxcd Fuzzing Engine: libFuzzer Fuzz Target: fuzzazuredevops Job Type: libfuzzerasanfluxcd Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000243000 Crash State: NULL Sanitizer: address ASAN Recommended...