GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: containerd, knative-serving, crossplane-provider-aws-elasticache, rancher-agent, atlantis, openbao, step, traefik, docker-cli-buildx, apko, crossplane-provider-keycloak, gomplate, mods, vitess, loki, flux-image-automation-controller, kaf, cloud-provider-aws, pulumi,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: containerd, knative-serving, rancher-agent, atlantis, openbao, step, docker-cli-buildx, apko, gomplate, mods, vitess, loki, flux-image-automation-controller, kaf, cloud-provider-aws, pulumi, opentofu, snyk-cli, tflint, grype, osv-scanner, step-issuer, argo-events,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: containerd, distribution, knative-serving, jaeger-operator, kube-arangodb, crossplane-provider-aws-elasticache, node-problem-detector, azurefile-csi, prometheus-adapter, kuma, chartmuseum, rancher-agent, openbao, step, newrelic-infrastructure-agent, traefik, gomplate...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: containerd, distribution, knative-serving, jaeger-operator, kube-arangodb, crossplane-provider-aws-elasticache, node-problem-detector, azurefile-csi, prometheus-adapter, kuma, chartmuseum, rancher-agent, openbao, step, newrelic-infrastructure-agent, traefik, gomplate...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

notification-controller 数据伪造问题漏洞

Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, zitadel, sftpgo-plugin-pubsub, loki, rke2-cloud-provider, gatekeeper-fips, spicedb-fips, tflint-fips, boring-registry, blob-csi-fips, beats-fips, kapp-controller-fips, longhorn-manager, cluster-api-helm-controller-fips, skaffold, tfsec,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: node-problem-detector, chartmuseum, kubernetes-dashboard-api, go-md2man, gosu, wireguard-go, crossplane-provider-keycloak, mods, gke-gcloud-auth-plugin, temporal-ui-server, dockerize, nri-nginx, osv-scanner, kube-vip, influx, litestream, kubeflow-katib, openfga, delv...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis, boring-registry, volume-modifier-for-k8s-fips, crossplane-provider-aws-ec2, helm-push, crossplane-provider-aws-cloudformation, kuberay-operator, skaffold, hubble-fips, crossplane-provider-azure-authorization, configmap-reload-fips,...