CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno-notation-aws-fips, flux-source-controller-fips, flux, kyverno, flux-source-controller...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, trivy-fips, trivy, cluster-api-helm-controller, harbor-fips, flux-helm-controller-fips, k9s, cilium-cli, k8ssandra-client-fips, pluto, chartmuseum-fips, kots, trivy-operator-fips, consul-k8s, chart-testing, rancher-fleet, cerbos-fips,...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: k9s, flux-helm-controller, helm-push, k8sgpt, zot, trivy, flux-source-controller, helm-operator, kubescape, zarf, kubevela, up, chartmuseum, eksctl, cilium-cli, kots...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: k9s, flux-helm-controller, helm-push, k8sgpt, zot, trivy, flux-source-controller, helm-operator, kubescape, zarf, kubevela, up, chartmuseum, eksctl, cilium-cli, kots...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, helm-push, rancher-fleet, flux-fips, helm-diff-fips, cert-manager-cmctl-fips, flux-source-controller-fips, helm-diff, gitlab-operator-fips, zarf-fips, flux, kuma, gitlab-operator, zarf, rancher-fleet-fips, flux-source-controller, cilium-cli, kots...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: nova-fips, gotenberg, victoriametrics, pgwatch, victoriametrics-cluster, omnictl-multiarch, localstack, aws-ebs-csi-driver, pluto, dkron, flux-notification-controller, podinfo, victoriametrics-cluster-fips, victorialogs, flux-image-reflector-controller,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: nova-fips, gotenberg, victoriametrics, pgwatch, victoriametrics-cluster, omnictl-multiarch, localstack, aws-ebs-csi-driver, pluto, dkron, flux-notification-controller, podinfo, victoriametrics-cluster-fips, victorialogs, flux-image-reflector-controller,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: trivy, grype, manifest-tool, helm-set-status, cilium-cli, chartmuseum-fips, k9s-fips, cloudbeat-fips, google-osconfig-agent, xeol-fips, helm-diff-fips, opa-fips-envoy, helm-operator-fips, fuse-overlayfs-snapshotter, zarf, kube-arangodb, kubevela-fips, nerdctl-fips,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: trivy, grype, manifest-tool, helm-set-status, cilium-cli, chartmuseum-fips, k9s-fips, cloudbeat-fips, google-osconfig-agent, xeol-fips, helm-diff-fips, opa-fips-envoy, helm-operator-fips, fuse-overlayfs-snapshotter, zarf, kube-arangodb, kubevela-fips, nerdctl-fips,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: kyverno-fips, aws-otel-collector, trivy, tkn, grype, cilium-cli, cluster-api, pgtimetable, istio-fips, tflint, opa-fips-envoy, argo-workflows, policy-controller, zarf, kyverno-notation-aws, glow, swagger, filebrowser, docker-compose-fips, harbor-cli, grype-fips,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, kubeflow-fips, tkn, trillian, memcached-exporter, kube-state-metrics, prometheus-mysqld-exporter, crossplane-provider-aws, kpt, metrics-server, prometheus-postgres-exporter, k8sgpt-operator, prometheus-pushgateway-fips, bank-vaults,...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, tkn, argo-workflows, bank-vaults, sops, policy-controller, zarf, neuvector-fips, dgraph, vault-csi-provider, gomplate, ko, temporal-ui-server, rekor, terragrunt, grpc-health-probe, gomplate-fips, k3s, rancher-agent, cosign, step, weaviate, guac,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: aactl, apko, ko, cosign, tkn, kubescape, slsa-verifier, tekton-chains, melange, spire-server-fips, skaffold, falcoctl-fips, flux-source-controller, policy-controller, spire-server...