Improper kubeconfig validation allows arbitrary code execution
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fluxcd | flux2 | flux2 < v0.29.0 >= v0.1.0; helm-controller < v0.23.0 >= v0.1.0; kustomize-controller < v0.19.0 >= v0.2.0 | — | No fix listed | CNA |
| — | github.com/fluxcd/flux2 (Go) | 0.1.0 to before 0.29.0 | 0.29.0 | Patch available | GHSA-vvmq-fwmg-2gjc |
| — | github.com/fluxcd/kustomize-controller (Go) | 0.1.0 to before 0.23.0 | 0.23.0 | Patch available | GHSA-vvmq-fwmg-2gjc |
| — | github.com/fluxcd/helm-controller (Go) | 0.2.0 to before 0.19.0 | 0.19.0 | Patch available | GHSA-vvmq-fwmg-2gjc |
- flux2 Vendorfluxcd Affected flux2 < v0.29.0 >= v0.1.0; helm-controller < v0.23.0 >= v0.1.0; kustomize-controller < v0.19.0 >= v0.2.0 Fixed in — No fix listed CNA
- github.com/fluxcd/flux2 (Go) Vendor— Affected 0.1.0 to before 0.29.0 Fixed in 0.29.0 Patch available GHSA-vvmq-fwmg-2gjc
- github.com/fluxcd/kustomize-controller (Go) Vendor— Affected 0.1.0 to before 0.23.0 Fixed in 0.23.0 Patch available GHSA-vvmq-fwmg-2gjc
- github.com/fluxcd/helm-controller (Go) Vendor— Affected 0.2.0 to before 0.19.0 Fixed in 0.19.0 Patch available GHSA-vvmq-fwmg-2gjc
CPE configurations NVD · 3
Remediation
- Fix · GHSA-vvmq-fwmg-2gjc github.com/fluxcd/flux2 (Go) Fixed in 0.29.0 Advisory →
- Fix · GHSA-vvmq-fwmg-2gjc github.com/fluxcd/kustomize-controller (Go) Fixed in 0.23.0 Advisory →
- Fix · GHSA-vvmq-fwmg-2gjc github.com/fluxcd/helm-controller (Go) Fixed in 0.19.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24817
- 2026-10-03 Alias added: GHSA-vvmq-fwmg-2gjc
References
More fluxcd Flux2 vulnerabilities
- TI-2022-08687 Improper path handling in kustomization files allows path traversal CVSS 3.1CRITICAL 9.9
- TI-2022-16473 Flux2 Helm Controller denial of service CVSS 3.1HIGH 7.7
- TI-2022-16460 Flux CLI Workload Injection CVSS 3.1HIGH 7.8
- TI-2022-08688 Improper path handling in Kustomization files allows for denial of service CVSS 3.1HIGH 7.7
- TI-2022-18648 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration CVSS 3.1MEDIUM 5.0
Sources
- CVE-2022-24817 · CVE Program
- CVE-2022-24817 · NVD
- FIRST EPSS
- GHSA-vvmq-fwmg-2gjc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences