PT-2026-31735 · Flux · Notification-Controller
Published
2026-04-09
·
Updated
2026-04-28
·
CVE-2026-40109
CVSS v3.1
3.1
Low
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Flux notification-controller versions prior to 1.8.3
Description
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token to authenticate against the Receiver webhook endpoint, potentially triggering unauthorized Flux reconciliations. Exploitation requires knowledge of the Receiver's webhook URL, which is generated as /hook/sha256sum(token+name+namespace). The controller triggers a reconciliation for all resources listed in the Receiver's .spec.resources, but the practical impact is limited as Flux reconciliation is idempotent and deduplicates requests.
Recommendations
Update to version 1.8.3 or later.
Fix
Insufficient Verification of Data Authenticity
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Notification-Controller