CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, kyverno-notation-aws-fips, flux, flux-source-controller, kyverno-notation-aws, kyverno...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, rancher-fleet, linkerd2, trivy, k8ssandra-client-fips, cerbos-fips, flux, teleport, harbor, trivy-fips, zarf, pluto, consul-k8s-fips, cerbos, chartmuseum, helm-operator-fips, tw, helm-docs, envoy-gateway-fips, eksctl, flux-fips, istio,...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: kubevela, chartmuseum, helm-operator, trivy, eksctl, k9s, k8sgpt, flux-helm-controller, kubescape, flux-source-controller, zot, kots, cilium-cli, zarf, up, helm-push...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, rancher-fleet, kuma, flux-source-controller-fips, rancher-fleet-fips, gitlab-operator, flux-fips, zarf-fips, flux, cert-manager-cmctl, helm-diff-fips, flux-source-controller, gitlab-operator-fips, kots, cilium-cli, zarf, helm-push, helm-diff...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: kubevela, chartmuseum, helm-operator, trivy, eksctl, k9s, k8sgpt, flux-helm-controller, kubescape, flux-source-controller, zot, kots, cilium-cli, zarf, up, helm-push...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: grafana-fips, loki-fips, cert-manager-fips, steampipe, victorialogs, aws-ebs-csi-driver-fips, pluto, librechat, polaris, victoriametrics-cluster-fips, flux-notification-controller, grafana-operator, victoriametrics-fips, aws-load-balancer-controller-fips, flux-fips,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: rancher-fleet, docker-cli-buildx, trivy-fips, xeol, google-osconfig-agent, falco-no-driver, rancher-agent, buildkitd, headlamp, rancher-helm, flux-helm-controller, kubescape, helm-fips, k3s, tekton-pipelines, cert-manager-cmctl, apm-server, neuvector-scanner-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: grafana-fips, loki-fips, cert-manager-fips, steampipe, victorialogs, aws-ebs-csi-driver-fips, pluto, librechat, polaris, victoriametrics-cluster-fips, flux-notification-controller, grafana-operator, victoriametrics-fips, aws-load-balancer-controller-fips, flux-fips,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: rancher-fleet, docker-cli-buildx, trivy-fips, xeol, google-osconfig-agent, falco-no-driver, rancher-agent, buildkitd, headlamp, rancher-helm, flux-helm-controller, kubescape, helm-fips, k3s, tekton-pipelines, cert-manager-cmctl, apm-server, neuvector-scanner-fips,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, trivy-fips, grafana-alloy-fips, terraform-mcp-server, atlantis, amazon-cloudwatch-agent-operator, prometheus, envoy-gateway-fips, kyverno-policy-reporter-ui, istio, spark-operator-fips, kube-bench, istio-fips, amazon-cloudwatch-agent-operator-fips,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: prometheus-mysqld-exporter, prometheus-mongodb-exporter, git-lfs, prometheus-adapter, terraform, buildkitd, bank-vaults, prometheus-adapter-fips, vault-k8s, flux-helm-controller, prometheus-pushgateway, prometheus-bind-exporter, pulumi-language-java,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: policy-controller, aactl, ko, tekton-chains, apko, melange, skaffold, cosign, flux-source-controller, spire-server-fips, falcoctl-fips, spire-server, tkn, kubescape, slsa-verifier...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: step, temporal-ui-server, sops, rancher-agent, bank-vaults, kubescape, k3s, gomplate-fips, ko-fips, kube-rbac-proxy, rekor, caddy, sigstore-scaffolding-fips, frp, minio-fips, dex-fips, skaffold, kots, argo-workflows-fips, tkn, vexctl, temporal-ui-server-fips, apko,...