GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: src, pulumi, helm, minio, docker, opentofu, crossplane-provider-aws-sqs, loki, tflint, nfpm, crossplane-provider-azure-authorization, caddy, fulcio, terragrunt, aactl, nerdctl, pulumi-language-dotnet, crossplane-provider-azure-storage, trivy, kots, rootlesskit,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: pulumi, helm, minio, docker, opentofu, loki, tflint, nfpm, crossplane-provider-azure-authorization, caddy, fulcio, terragrunt, aactl, nerdctl, pulumi-language-dotnet, crossplane-provider-azure-storage, trivy, kots, rootlesskit, k3s, step-kms-plugin, flux, melange,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: vcluster, cluster-api-helm-controller, kube-rbac-proxy, cortex, metrics-server, calico, argo-rollouts, skopeo, helm-operator, minio, vault-env, cert-manager-istio-csr, opentofu, envoy-gateway, terraform-provider-grafana, loki, migrate, cert-manager-cmctl, tflint,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: vcluster, cluster-api-helm-controller, kube-rbac-proxy, cortex, metrics-server, calico, argo-rollouts, skopeo, helm-operator, minio, vault-env, cert-manager-istio-csr, opentofu, envoy-gateway, terraform-provider-grafana, loki, migrate, cert-manager-cmctl, tflint,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

notification-controller 数据伪造问题漏洞

Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: scorecard, temporal-server-fips, flux-source-controller-fips, cluster-api-helm-controller-fips, longhorn-manager, cloudprober, kyverno-notation-aws-fips, azuredisk-csi-fips, k8s-agents-operator-fips, rke2-cloud-provider, kaniko-fips, aws-otel-collector,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: grafana-operator, argo-rollouts, skopeo, flannel-cni-plugin, sftpgo-plugin-auth, whereabouts, pdfcpu, vault-k8s, petname, lazydocker, kserve, k6, nri-prometheus, containerd, kubernetes-dashboard-web, docker-credential-ecr-login, trillian, descheduler, kbld, sftpgo,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: scorecard, kyverno-policy-reporter-kyverno-plugin, wavefront-collector-for-kubernetes, configmap-reload, temporal-server-fips, metallb, crossplane-provider-azure-sql, gitsign, crossplane-provider-aws-sns, thanos-operator, vault-csi-provider,...