Read the docs

fluxcd

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

fluxcd records in CISA KEV

No fluxcd vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Flux2 6 records MEDIUM Kustomize-controller 5 records MEDIUM Helm-controller 3 records MEDIUM Image-automation-controller 1 record LOW Image-reflector-controller 1 record LOW Notification-controller 1 record LOW Source-controller 1 record LOW

Records

10 records

TI-2021-18089 CVE-2021-41254 · GHSA-35rf-v2jv-gfg7

Privilege escalation to cluster admin on multi-tenant environments

Priority MEDIUM 42

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01824 Published 2021-11-12 Fixed in 0.15.0 CWE-78
TI-2022-16473 CVE-2022-36049 · GHSA-p2g7-xwvr-rrw3

Flux2 Helm Controller denial of service

Priority LOW 37

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01542 Published 2022-09-07 Fixed in 0.23.0, 0.32.0 CWE-400
TI-2022-16460 CVE-2022-36035 · GHSA-xwf3-6rgv-939r

Flux CLI Workload Injection

Priority LOW 36

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00318 Published 2022-08-31 Fixed in 0.32.0 CWE-22
TI-2026-35185 CVE-2026-47680 · GHSA-jjrm-hr5f-673x

Source controller: Improper path handling allows traversal

Priority LOW 24

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00459 Published 2026-09-08 Fixed in 1.8.5 CWE-23
Open these records in search →