CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, flux, kyverno, kyverno-notation-aws, kyverno-notation-aws-fips, flux-source-controller...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: eksctl, helm-push, kots, kubescape, up, zarf, chartmuseum, k8sgpt, k9s, flux-source-controller, trivy, flux-helm-controller, helm-operator, cilium-cli, kubevela, zot...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, helm-push, chartmuseum, cluster-api-helm-controller, envoy-gateway, pluto, flux-helm-controller, flux-source-controller, cert-manager-cmctl-fips, trivy-operator-fips, chart-testing, chart-testing-fips, helm-operator-fips,...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, flux, helm-push, kots, rancher-fleet, cert-manager-cmctl, rancher-fleet-fips, zarf, flux-fips, gitlab-operator-fips, helm-diff-fips, gitlab-operator, zarf-fips, flux-source-controller, helm-diff, cilium-cli, cert-manager-cmctl-fips, kuma...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: eksctl, helm-push, kots, kubescape, up, zarf, chartmuseum, k8sgpt, k9s, flux-source-controller, trivy, flux-helm-controller, helm-operator, cilium-cli, kubevela, zot...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: grafana-fips, victoriametrics-fips, terragrunt, gotenberg, loki-fips, omnictl-multiarch, victorialogs-fips, pluto, flux-helm-controller, flux-source-watcher, victoriametrics-cluster, flux-source-controller, go, grafana-operator, victoriametrics,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, docker-cli-buildx, helm-push, neuvector-scanner-fips, docker-compose, cloudbeat, helm-operator-fips, datadog-agent, manifest-tool, kaniko, gitlab-rails-ce, k8ssandra-client, rancher-fleet, datadog-agent-fips, kube-arangodb-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: grafana-fips, victoriametrics-fips, terragrunt, gotenberg, loki-fips, omnictl-multiarch, victorialogs-fips, pluto, flux-helm-controller, flux-source-watcher, victoriametrics-cluster, flux-source-controller, go, grafana-operator, victoriametrics,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, docker-cli-buildx, helm-push, neuvector-scanner-fips, docker-compose, cloudbeat, helm-operator-fips, datadog-agent, manifest-tool, kaniko, gitlab-rails-ce, k8ssandra-client, rancher-fleet, datadog-agent-fips, kube-arangodb-fips,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, grafana-alloy, docker-cli-buildx, kyverno-policy-reporter-fips, hcloud, kubecolor, opentelemetry-operator, mattermost-fips, opentelemetry-collector-contrib-fips, traefik, cosign, cosign-fips, kube-bench, guac, kube-state-metrics-fips,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter, cue, bank-vaults-fips, k3d, kubernetes-csi-external-provisioner, bank-vaults, cosign, trillian, weaviate, kube-state-metrics-fips, nodetaint, kubernetes-dashboard, kubeflow-katib, memcached-exporter, aws-load-balancer-controller,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: tekton-chains, ko, tkn, kubescape, aactl, spire-server-fips, slsa-verifier, apko, falcoctl-fips, spire-server, melange, cosign, flux-source-controller, skaffold, policy-controller...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: bank-vaults-fips, bank-vaults, cosign, cosign-fips, weaviate, guac, vault, kubernetes-dashboard, argo-workflows, sigstore-scaffolding-fips, tkn, temporal, sigstore-scaffolding, fulcio-fips, sops, policy-controller-fips, kube-rbac-proxy-fips, caddy, neuvector,...