Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

notification-controller 数据伪造问题漏洞

Notification-Controller is a GitOps notification controller open source in the Flux project. Versions of Notification-Controller prior to 1.8.3 had a data manipulation vulnerability. This vulnerability stemmed from the lack of verification of the email claim for Google OIDC tokens, which could...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: onepassword-operator, reports-server, kube-metrics-adapter-fips, jobset-fips, sops, cert-manager-webhook-pdns, velero-plugin-for-gcp, gitaly, sftpgo-plugin-kms, packer, cluster-api-gcp-controller, google-osconfig-agent, cloudprober-fips,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: dask-gateway, terraform-docs, direnv, velero-plugin-for-microsoft-azure, configmap-reload, argo-rollouts, helm-operator, controller-gen, gobump, nri-prometheus, croc, kafka-proxy, kserve-modelmesh-serving, nri-nginx, kubernetes-csi-livenessprobe, fluent-operator,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, nri-kubernetes, protoc-gen-go-grpc, sops, prometheus-nats-exporter, k8sgpt-operator, crossplane-provider-aws-eks, crossplane-provider-aws-sqs, tigera-operator, thanos, temporal-server-fips, fulcio-fips,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: snyk-cli, melange, task, flux-notification-controller, pulumi-kubernetes-operator, argo-workflows, argo-events, argo-events-fips...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, melange, task, flux-notification-controller, pulumi-kubernetes-operator, argo-workflows, argo-events, argo-events-fips...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: melange, argo-workflows, snyk-cli, task, argo-events, flux-notification-controller, pulumi-kubernetes-operator...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubescape, bank-vaults-fips, slsa-verifier, src, kube-oidc-proxy, smarter-device-manager-fips, scorecard, kubevela, kubeflow-fips, plutono-fips, cortex, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid-fips, buildkitd, vault-csi-provider, kubeflow,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, aactl, src, terraform-provider-sendgrid, dgraph, cortex, spark-operator, up, k3d, kubescape, buildkitd, kubevela, scorecard, slsa-verifier...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: dgraph, gomplate, hugo, atlantis, kubewatch, amass, nri-prometheus, stakater-reloader, k3d, scorecard, kubernetes-csi-livenessprobe, sigstore-scaffolding, flux-helm-controller, grpcurl, hey, frp, kaf, pulumi-kubernetes-operator, newrelic-infrastructure-agent, pulumi,...