CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno-notation-aws-fips, kyverno, flux, flux-source-controller, flux-source-controller-fips...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: trivy-fips, kargo, consul-k8s-fips, cert-manager-cmctl, k8ssandra-client, flux-source-controller, helm-docs, chart-testing, chartmuseum, istio, rancher-fleet-fips, k8ssandra-client-fips, zarf, flux-fips, envoy-gateway-fips, trivy, flux-helm-controller,...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: zarf, cilium-cli, trivy, flux-helm-controller, helm-push, eksctl, kots, kubescape, kubevela, flux-source-controller, k8sgpt, k9s, zot, up, chartmuseum, helm-operator...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: zarf, cilium-cli, trivy, flux-helm-controller, helm-push, eksctl, kots, kubescape, kubevela, flux-source-controller, k8sgpt, k9s, zot, up, chartmuseum, helm-operator...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: helm-diff-fips, gitlab-operator-fips, zarf-fips, zarf, cilium-cli, flux-fips, cert-manager-cmctl-fips, kuma, flux, cert-manager-cmctl, kots, rancher-fleet, flux-source-controller, gitlab-operator, helm-diff, flux-source-controller-fips, helm-push, rancher-fleet-fips...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: polaris, go, nova, flux-image-automation-controller, cluster-autoscaler-fips, flux-notification-controller, flux-source-controller, flux-operator, flux-source-watcher, aws-ebs-csi-driver-fips, flux-image-reflector-controller, victoriametrics-fips, stakater-reloader,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: trivy-fips, beats, k8ssandra-client, helm-diff, rancher-fleet-fips, kube-arangodb, neuvector-scanner, newrelic-infrastructure-agent, beats-fips, trivy, manifest-tool, kots, xeol, buildkitd, datadog-agent-fips, opa-fips, datadog-agent, tekton-pipelines-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: polaris, go, nova, flux-image-automation-controller, cluster-autoscaler-fips, flux-notification-controller, flux-source-controller, flux-operator, flux-source-watcher, aws-ebs-csi-driver-fips, flux-image-reflector-controller, victoriametrics-fips, stakater-reloader,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: trivy-fips, beats, k8ssandra-client, helm-diff, rancher-fleet-fips, kube-arangodb, neuvector-scanner, newrelic-infrastructure-agent, beats-fips, trivy, manifest-tool, kots, xeol, buildkitd, datadog-agent-fips, opa-fips, datadog-agent, tekton-pipelines-fips,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: agentbeat-fips, cluster-api, argo-events-fips, trivy-fips, splunk-otel-collector-fips, kyverno-notation-aws-fips, terraform-mcp-server, guac, conftest, atlantis, dive, trivy, docker-compose-fips, aws-otel-collector-fips, kots, syft-fips, kyverno-policy-reporter-ui,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, kube-state-metrics, prometheus-mysqld-exporter, node-problem-detector, dive, newrelic-infrastructure-agent, prometheus-elasticsearch-exporter-fips, nodetaint, kots, kubernetes-dashboard, prometheus-alertmanager, buildkitd, kiam,...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: caddy-fips, step, guac, temporal, kots, kubernetes-dashboard, spire-server, policy-controller-fips, sops, vault-csi-provider, skopeo, bank-vaults-fips, minio, kube-oidc-proxy, neuvector-fips, vault, kube-rbac-proxy-fips, policy-controller, wolfictl,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: aactl, ko, apko, spire-server-fips, slsa-verifier, skaffold, tekton-chains, tkn, policy-controller, flux-source-controller, falcoctl-fips, cosign, spire-server, melange, kubescape...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: podman-fips, kyverno-notation-aws, zarf-fips, undock, kyverno-notation-aws-fips, kyverno, flux-source-controller, kubescape-server, portieris-fips, buildah, zarf, slsa-verifier, tekton-chains, kots, ratify, skopeo-fips, tekton-chains-fips, kubescape-server-fips,...

GO-2026-5014 vulnerabilities

Vulnerabilities for packages: trivy-fips, chisel-fips, external-dns, kube-state-metrics, etcd, knative-kafka-broker-fips, argo-cd, trivy, kots, cilium, kubernetes-dashboard, spire-server, nemo, mattermost, tekton-pipelines-fips, flux-source-controller-fips, harbor-fips,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno-notation-aws-fips, goreleaser, kyverno, policy-controller, tkn, tkn-fips, flux-source-controller, image-factory-fips, ratify, tekton-chains-fips, zot, falcoctl-fips, policy-controller-fips, witness, kyverno-policy-reporter-plugins-kyvern...

GO-2026-4355 vulnerabilities

Vulnerabilities for packages: trivy-fips, tflint, ko, kyverno-notation-aws, neuvector-sigstore-interface, crossplane-fips, neuvector-sigstore-interface-fips, cosign-fips, kyverno-notation-aws-fips, goreleaser, kyverno, policy-controller, tkn, tkn-fips, flux-source-controller, cosign, crossplane,...