Vulnerabilities

TI-2026-35185 CVE-2026-47680 · GHSA-jjrm-hr5f-673x

Source controller: Improper path handling allows traversal

LOW 24

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00459 Published 2026-09-08 Fixed in 1.8.5 CWE-23

TI-2026-28935 CVE-2026-40109 · GHSA-h9cx-xjg6-5v2w

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

LOW 14

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00132 Published 2026-04-09 Fixed in 1.8.3 CWE-287

TI-2024-20593 CVE-2024-31216 · GHSA-v554-xwgw-hc3w

source-controller leaks theAzure Storage SAS token into logs on connection errors

LOW 23

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00213 Published 2024-05-15 Fixed in 1.2.5 CWE-532

TI-2022-18648 CVE-2022-39272 · GHSA-f4p5-x4vc-mh4v

Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

LOW 24

Flux is an open and extensible continuous delivery solution for Kubernetes.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00788 Published 2022-10-21 Fixed in 0.35.0, 0.30.0 +8 CWE-1284

TI-2022-16473 CVE-2022-36049 · GHSA-p2g7-xwvr-rrw3

Flux2 Helm Controller denial of service

LOW 37

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01542 Published 2022-09-07 Fixed in 0.23.0, 0.32.0 CWE-400

TI-2022-16460 CVE-2022-36035 · GHSA-xwf3-6rgv-939r

Flux CLI Workload Injection

LOW 36

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00318 Published 2022-08-31 Fixed in 0.32.0 CWE-22

TI-2022-08688 CVE-2022-24878 · GHSA-7pwf-jg34-hxwp

Improper path handling in Kustomization files allows for denial of service

LOW 36

Flux is an open and extensible continuous delivery solution for Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01018 Published 2022-05-06 Fixed in 0.24.0, 0.29.0 CWE-22

TI-2022-08687 CVE-2022-24877 · GHSA-j77r-2fxf-5jrw

Improper path handling in kustomization files allows path traversal

MEDIUM 45

Flux is an open and extensible continuous delivery solution for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01187 Published 2022-05-06 Fixed in 0.24.0, 0.29.0 CWE-22

TI-2022-08630 CVE-2022-24817 · GHSA-vvmq-fwmg-2gjc

Improper kubeconfig validation allows arbitrary code execution

MEDIUM 45

Flux2 is an open and extensible continuous delivery solution for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01118 Published 2022-05-06 Fixed in 0.29.0, 0.23.0 +1 CWE-94

TI-2021-18089 CVE-2021-41254 · GHSA-35rf-v2jv-gfg7

Privilege escalation to cluster admin on multi-tenant environments

MEDIUM 42

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01824 Published 2021-11-12 Fixed in 0.15.0 CWE-78

Vulnerabilities

Filters