49 matches found
GHSA-HC8V-WWC9-VGXM vulnerabilities
Vulnerabilities for packages: grafana-alloy, pulumi-language-dotnet, argo-cd, kyverno, steampipe, goreleaser, snyk-cli, gomplate, nuclei, trivy, dagger, gitaly, crossplane, flux-notification-controller, act, witness, argo-workflows, argo-events, boring-registry, k9s, trufflehog, zot, kargo,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: tflint, policy-controller, opentofu, eksctl, crossplane-provider-azure-storage, snyk-cli, fscrypt, nerdctl, terraform-provider-azurerm, rancher, gh, flux-kustomize-controller, guac, rancher-machine, crossplane-provider-azure-authorization, prometheus, minio,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: tflint, policy-controller, opentofu, eksctl, crossplane-provider-azure-storage, snyk-cli, fscrypt, nerdctl, terraform-provider-azurerm, rancher, gh, flux-kustomize-controller, guac, rancher-machine, crossplane-provider-azure-authorization, prometheus, minio,...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: tflint, kubernetes-dns-node-cache, juicefs, policy-controller, opentofu, eksctl, crossplane-provider-azure-storage, haproxy-ingress, ratify, linkerd2, goreleaser, snyk-cli, envoy-ratelimit, azuredisk-csi, aws-otel-collector, secrets-store-csi-driver-provider-gcp,...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: tflint, kubernetes-dns-node-cache, juicefs, policy-controller, opentofu, eksctl, crossplane-provider-azure-storage, haproxy-ingress, ratify, linkerd2, goreleaser, snyk-cli, envoy-ratelimit, azuredisk-csi, aws-otel-collector, secrets-store-csi-driver-provider-gcp,...
SUSE CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
EUVD-2026-21150
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109
CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
PT-2026-31735
Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...
CVE-2026-40109: Improper Authentication
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
notification-controller 数据伪造问题漏洞
Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...